Re: [Full-disclosure] Unpatched IIS Vulnerabilities / Microsoft July Security Bulletin

["Thor \(Hammer of God\)" <thor () hammerofgod com>]

Right - if you've compromised the server to the point you can alter
directory structures/names, the you've already bypassed the ACLs required
in order to "exploit" the vulnerability that allows you to bypass the
ACLs.  I don't get it.

t




On 7/16/12 10:47 AM, "Григорий Братислава" <musntlive () gmail com> wrote:

> On Mon, Jul 16, 2012 at 1:24 PM, king cope
> <isowarez.isowarez.isowarez () googlemail com> wrote:
> > Hi Lists,
> >
> > it seems Microsoft doesn't want to patch the vulnerabilities I posted
> > back in June,
> > at least not in the July update.
>
> Hello Full Disclosure!! !! !!
>
> Is like to introduce you to Schrödinger's Cat and Wigner's Friend in
> is Computer Security. 'The Wigner's Friend thought experiment posits a
> friend of Wigner who performs the Schrödinger's cat experiment after
> Wigner leaves the laboratory. Only when he returns does Wigner learn
> the result of the experiment from his friend, that is, whether the cat
> is alive or dead. The question is raised: was the state of the system
> a superposition of "dead cat/sad friend" and "live cat/happy friend,"
> only determined when Wigner learned the result of the experiment, or
> was it determined at some previous point?'
>
> http://en.wikipedia.org/wiki/Wigner's_friend
> http://en.wikipedia.org/wiki/Schr%C3%B6dinger%27s_cat
>
> IIS is neither vulnerable or not vulnerable. Is until you is exploit
> it and verify!
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/