Re: KeePass version 2.12 <= Insecure DLL Hijacking Vulnerability (dwmapi.dll)

[Christian Sciberras <uuf6429 () gmail com>]

http://support.microsoft.com/kb/2264107

That is installed both in my win7 64bit workstation system and the
32bit XP Pro (virtualized) system.
For the matter, that POC never worked on my PC, at least their initial
implementation was always flawed.
(speaking of which, did they really have to fail it when my own POC,
written under an hour, worked perfectly?)

If you still think my POC was wrong, please do try it and highlight
what is wrong with it.
Though I take no offense in no one trying it - it was more of personal
satisfaction than real use, hence it being written in Lazarus.

Cheers,
Chris.


On Thu, Sep 9, 2010 at 12:00 AM,  <paul.szabo () sydney edu au> wrote:
> Christian Sciberras <uuf6429 () gmail com> wrote:
>
> > MS issued a patch quite some time ago.
>
> Would you be able to give a reference to that patch, and comment on
> its relationship to the recent
>
>  Microsoft Security Advisory (2269637)
>  Insecure Library Loading Could Allow Remote Code Execution
>  http://www.microsoft.com/technet/security/advisory/2269637.mspx
>
> ?
>
> > This "vulnerability" is no more on all of MS's OSes ...
> > I ... tested ... the vulnerability didn't work).
>
> May I suggest that you tested wrong: I followed
>
>  Online Binary Planting Exposure Test
>  http://lists.grok.org.uk/pipermail/full-disclosure/2010-September/076293.html
>
> and it "worked" for me, on my patched-to-the-limit WinXP.
>
> Cheers, Paul
>
> Paul Szabo   psz () maths usyd edu au   http://www.maths.usyd.edu.au/u/psz/
> School of Mathematics and Statistics   University of Sydney    Australia

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/