Re: Local persistent DoS in Windows XP SP2 Taskmanager

[3APA3A <3APA3A () SECURITY NNOV RU>]

Dear SkyOut,

I see no security impact here.

RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting", 0, KEY_SET_VALUE, &hKey);

requires  administrative  privileges.  If user has ones, you can achieve
better results by deleting task manager of trojaning it.

You can also use

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows    NT\CurrentVersion\Image
File Execution Options\taskmgr.exe\Debug

key to launch notepad.exe instead of taskmgr.exe.

--Friday, March 14, 2008, 10:49:31 PM, you wrote to full-disclosure () lists grok org uk:

S> Dear list,

S> after weeks of total ignorance by Microsoft I decided to finally  
S> release all information
S> related to a bug, that has to do with the Windows XP SP2 Taskmanager.
S> Manipulating
S> a Registry key makes it possible to disable the Taskmgr. On the next
S> startup it will crash with
S> an error message. It is possible to backup the key and repair the  
S> Registry doing so, but
S> the attack scenario is clear: A virus uses this code, the user can't
S> open the Taskmgr anymore
S> and your process is somehow "hidden".

S> The full information about this bug, can be found here:
S> http://core-security.net/archive/2008/march/index.php#14032008

S> And the exploit is available here:
S> http://core-security.net/releases/exploits/taskmgr_dos.c.txt

S> Greets,
S> SkyOut

S> ---
S> core-security.net
S> ---


-- 
~/ZARAZA http://securityvulns.com/
ЭНИАКам - по морде!  (Лем)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/