Bugtraq mailing list archives
RE: [ok] [Full-Disclosure] RE: Unchecked buffer in mstask.dll
From: "Curt Purdy" <purdy () tecman com>
Date: Fri, 16 Jul 2004 14:29:27 -0500
Dmitry Yu wrote:
Being curious, on Win2k, I copied cmd.exe (fromwinnt\system32) as xyz.pif;then (right-click) Properties, Program crashes explorer. Isthis related toIconHandler, and is it exploitable?Disassembly window shows that there was an attempt to read dword at [EAX] (EAX=0). So at first glance this doesn't seem to be trivially exploitable, but I'm not a win32 expert, and intuition suggests that there must be a way.
One possible exploit is to simply place the file on your desktop. explorer.exe goes to 100% cpu. Curt Purdy CISSP, GSEC, MCSE+I, CNE, CCDA Information Security Engineer DP Solutions ---------------------------------------- If you spend more on coffee than on IT security, you will be hacked. What's more, you deserve to be hacked. -- former White House cybersecurity adviser Richard Clarke
Current thread:
- Unchecked buffer in mstask.dll Brett Moore (Jul 14)
- <Possible follow-ups>
- RE: Unchecked buffer in mstask.dll Thor Larholm (Jul 14)
- Re: Unchecked buffer in mstask.dll Mark Litchfield (Jul 16)
- RE: Unchecked buffer in mstask.dll Paul Szabo (Jul 15)
- RE: Unchecked buffer in mstask.dll Dmitry Yu. Bolkhovityanov (Jul 18)
- RE: [ok] [Full-Disclosure] RE: Unchecked buffer in mstask.dll Curt Purdy (Jul 18)
- Re: [Full-Disclosure] RE: Unchecked buffer in mstask.dll Jordan Cole (stilist) (Jul 18)
- Re: [Full-Disclosure] RE: Unchecked buffer in mstask.dll Nick FitzGerald (Jul 18)
- Re: [Full-Disclosure] RE: Unchecked buffer in mstask.dll Curt Purdy (Jul 18)
- RE: Unchecked buffer in mstask.dll Dmitry Yu. Bolkhovityanov (Jul 18)
- RE: Unchecked buffer in mstask.dll Thor Larholm (Jul 15)