full-disclosure - Official IFRAME patch - make sure it installs correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: des_ward at o2.co.uk (Des Ward)
Subject: Official IFRAME patch - make sure it installs correctly

Has anyone confirmed that the XP Sp1 and/or NT4 windows update patch(es) work with regards to skylined's exploit code; or do we have to deploy the .exe file?

Only asking cos I can't test this until I get home to my lab tonight.

Cheers,

Des
-----Original Message-----
From: "morning_wood" <se_cur_ity@...mail.com>
Date: Thu, 2 Dec 2004 00:58:12 
To:"Kevin" <kkadow@...il.com>, <full-disclosure@...ts.netsys.com>
Subject: Re: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

I can confirm on WinXP SP1 ( download the [patch].exe run and reboot)
 Mr Wever's exploit PoC did not run ( no shell, dialog warning )

cheers,
m.w

> > The IFRAME vulnerability has been patched, see
http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx
>
> The wording in ms04-040 is so vague, I am not entirely sure that this
> patch is a fix for the IFRAME bug(s)?
>
> > *** Make sure you are patched after installing ***
> > I installed it using "Automatic Updates" (on Win2ksp4), rebooted and
loaded my InternetExploiter.html: IT STILL WORKED!!
> > Even though both "Automatic Updates" and
"http://windowsupdate.microsoft.com" reported that I was patched!?!
> > I manually downloaded the exe and ran it, rebooted and now I'm finally
truely patched.
>
> Just so I am clear, after automatic updates applied the "critical
> patch" on W2KSP4 and rebooted, the IFRAME exploit still worked, but
> manually downloading the executable given in the Microsoft alert and
> running it results in a system on which the IFRAME exploit no longer
> works?
>
> This would be confirmation that ms04-040 actually does address the
> IFRAME exploit.
>
>
> Kevin
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Kind regards,

Des Ward