Re: Re: It's not that simple...

[Florian Weimer <fw () deneb enyo de>]

* Jason Coombs:

> Kurt Seifried wrote:
> > Actually it really is that simple. Disabling Null sessions is
> > entirely possible, quite easy, and doesn't break a lot (at least in
> > my previous
>
> Then why doesn't Microsoft provide these instructions in the workarounds 
> section of the vulnerability announcement?

Attacks using proper accounts are still possible, AFAIK.  These days,
it's hard to explain such fine points in advisories because all the
useful details have been eliminated and vendors fear to give away too
much information.  In the present case, it didn't help to delay the
exploit, of course.

> I'm supposed to do Microsoft's job for them? No way.

Well, it's your computers that are potentially compromised, not
theirs.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/