Re: CR II - winME? confirmation? (Slightly OT)

["kam" <kam () aversion net>]

Without IIS running, an attacker has no means of exploiting the vulnerable
file. With no access to the file, the vulnerability does not exist. If
they're running IIS, then there is a hole which they can exploit. Even
though it comes installed by default on 2000, it's not a risk until you turn
on your web services.

kam

----- Original Message -----
From: "Amer Karim" <amerk () telus net>
To: "VULN-DEV List" <VULN-DEV () SECURITYFOCUS COM>
Sent: Tuesday, August 07, 2001 10:03 AM
Subject: Re: CR II - winME? confirmation? (Slightly OT)


> Hi All,
>
> All the advisories about CR state that only IIS servers are vulnerable.
> However, it's my understanding that the unchecked buffer in idq.dll was
the
> source of that vulnerability.  If that's the case, then why have the
> advisories not included Win2K systems (all flavours) since idq.dll is
> installed by default as part of the indexing service on all these
systems -
> regardless of whether they are using the service or not?  Wouldn't that
make
> ANY system with the indexing service on it just as vulnerable as systems
> with IIS? Am I overlooking something obvious here?
>
> Regards,
> Amer Karim
> Nautilis Information Systems
> e-mail: amerk () telus net, mamerk () hotmail com