Re: ASLR+DEP = no problem. :>

[Moshe Ben Abu <mtrancer () gmail com>]

Yep, I agree with Thierry, once the technique will be fixed - ASLR+DEP = big
problem :(

Past examples:
 - Java Virtual Machine Heap Spray > Java is out of process since 1.6.0u10.
 - Actionscript Heap Spray > Flash 10 got DEP and ASLR.
 - .NET User Control binary > Internet Explorer 8 RTM blocks it on Internet
Zone.

In addition, latest versions of Adobe Reader, QuickTime and .NET Framework
got DEP and ASLR enabled too...

On Thu, Feb 4, 2010 at 1:14 PM, Thierry Zoller <Thierry () zoller lu> wrote:

> Hi,
> This -
> > It does this by playing some very odd tricks with
> > Flash's JIT compiler.
> +
> > In other words, ASLR
> > and DEP are not longer the shield they once were.
> Doesn't compute. You are relying on oddities, fix
> the oddities and ASLR/DEP are back again.
>
> --
> http://blog.zoller.lu
> Thierry Zoller
>
>
> _______________________________________________
> Dailydave mailing list
> Dailydave () lists immunitysec com
> http://lists.immunitysec.com/mailman/listinfo/dailydave



-- 
Trancer
Recognize-Security
http://www.rec-sec.com

_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave