full-disclosure - Re: Windows .ANI LoadAniIcon Stack Overflow

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 02 Apr 2007 18:19:25 -0700
From: Alexander Sotirov <asotirov@...ermina.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Windows .ANI LoadAniIcon Stack Overflow

Larry Seltzer wrote:
> I'm beginning to think that web-based attacks with this in Vista aren't
> really so scary. Even if you can get them to execute what can you really
> do in IE protected mode?

I just posted a video of exploiting IE7 and Firefox on Vista. Internet Explorer
was running in protected mode with DEP disabled (this is the default Vista
setup). It's interesting that the protected mode of IE does not stop the
execution of cmd.exe, but it does prevent you from writing to the file system
once you get the shell.

http://determina.blogspot.com/

Alexander Sotirov
Determina Security Research

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/