bugtraq - Re: First vulnerabilities in the SP2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 18 Aug 2004 09:41:16 +0200
From: Radoslav DejanoviÄ‡ <radoslav.dejanovic@...us.hr>
To: bugtraq@...urityfocus.com
Subject: Re: First vulnerabilities in the SP2 - XP ?...

On Monday 16 August 2004 15:58, Jérôme ATHIAS wrote:
> http://www.heise.de/security/artikel/50051

This basically tells the user to open CMD and then execute the attachment 
in command line. Now, someone has to be really, really dumb to do that.

The good point here is that people don't know what CMD is and might be 
reluctant to do something they do not understand. I wouldn't say this is 
SP2 vulnerability, it might just be that noone tought about such an 
exploit. However, I think it doesn't have to do with Microsoft, but with 
less than average IQ of some users. There's no company, not Microsoft, not 
IBM, not Linux nor BSD, that can make a 100% foolproof system. 

This might be SP2 bug only if the same bug can't be repeated on pre-SP2 
machine. Didn't test, but I think this is an old trick. Anyone care to 
test it?

-- 
Radoslav DejanoviÄ‡
Operacijski sustavi d.o.o.
http://www.opsus.hr