From: Paul.Tinsley at phyve.com (Paul Tinsley)
Subject: XP security hole uplddrvinfo.htm

You people amaze me.... you are too busy proving that each other suck to
just get the word out on exploits.  You should note that I never claimed
who discovered it, I honestly don't care.  I know personally I would
prefer if political agendas or conspiracy theories stay off the list.
Point is, systems are insecure, get the word out.  Pat on the back for
whoever did discover it...

 So revised version of original message: 
I haven't seen much if any coverage of a rather nasty exploit in Windows
XP that was discovered by what I believe was a human on earth.  If you
would like to keep your XP boxes from being venerable to this exploit
which happens to delete whatever a properly formed link requests, delete
%windir%\PCHEALTH\HELPCTR\System\DFS\uplddrvinfo.htm

Thank you to Thor for posting more accurate information in reply to my
message....
Shane Hird discovered it.
You can see his post here:

http://cert.uni-stuttgart.de/archive/bugtraq/2002/08/msg00224.html

And you can try a proof-of-concept here:

http://jscript.dk/2002/8/sec/xphelpdelete.html

And you can see all of the 20 publicly known unpatched vulnerabilities
in Internet Explorer here:

http://www.pivx.com/larholm/unpatched/


-----Original Message-----
From: gobbles@...h.com [mailto:gobbles@...h.com] 
Sent: Tuesday, September 10, 2002 2:36 PM
Subject: Re: [Full-Disclosure] XP security hole uplddrvinfo.htm


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Steve Gibson=FUD charlaten   www.grcsucks.com

>Sorry if this has already been posted but I was made aware of a
> rather
>ugly security hole in Windows XP.
>

FUD FUD FUD

>This vulnerability allows the files contained in any specified
>directory
>on your system to be deleted if you click on a specially formed
> URL.
>This URL could appear anywhere: sent in malicious eMail, in a c
>hat room,
>in a newsgroup posting, on a malicious web page, or even execut
>ed when

Geogie Guninski discovered this long time ago.  Major vulnerability also
exist if user type format command wrong.

Gibson no skills not discover this.

>your computer merely visits a malicious web page. It is likely
>to be
>widely exploited soon.

Widely exploited soon?  Gibson planning something?

bullshit bullshit bullshit


>This vulnerability is so dangerous that it would be irresponsib
>le for me
>to say more. Microsoft has known of this problem for months and

FUD FUD FUD bullshit bullshit bullshit.  Gibson is marketing.  General
terms high level bullshit mean more consultant dollars.

> has,
>inexplicably, done nothing before now. Although XP's Service Pa
>ck 1 is
>not small (approx 30 MB for express installation or 140 MB for
>the
>network install), and even though a much quicker and easier sol
>ution to
>this problem exists, the only thing I can safely recommend (wit
>hout
>revealing too much) is to urge all XP users to somehow obtain a
>nd
>install Service Pack 1 immediately. (If you have a slow Interne
>t
>connection, perhaps a friend can download the executable Servic
>e Pack
>file and burn it onto a CD for you?)

More fud fud fud bullshit bullshit bullshit.  Problem fixed with hotfix
not sp1.  Gibson very dumb.

>This problem does not affect any systems other than Windows XP.
> If you
>have any friends or co-workers running Windows XP, please urge
>them to
>update their systems' too. Once the details of this vulnerabili
>ty have
>leaked through other channels I will provide additional informa
>tion.

Gibson planning leak?  Tell friends that Gibson great security guy and
pay to consult.  bullshit bullshit bullshit FUD FUD FUD

>there is an alternative. There's a file you can rename or delet
>e to fix
>the security hole. Here are the steps:
>
>Perform a search for a file on your C drive called "uplddrvinfo
>.htm."
>Once you've found the file, delete it or rename it. Doing so wi
>ll not
>hinder your ability to use Windows XP.

bullshit bullshit bullshit.

Does not fix problem.  Gibson is dumb.

-----BEGIN PGP SIGNATURE-----
Version: Hush 2.1
Note: This signature can be verified at https://www.hushtools.com

wlgEARECABgFAj1+RfMRHGdvYmJsZXNAaHVzaC5jb20ACgkQpmwDHEAx56siiwCgkCxM
SwzADNeDmHjVlFWgxDpK9yoAn3sN5Hqhxdyn9xOAFsdmtRYDN3Vd
=Ok0V
-----END PGP SIGNATURE-----




Get your free encrypted email at https://www.hushmail.com

Powered by blists - more mailing lists