full-disclosure - Re: denial-of-service vulnerability in the Microsoft Malicious Software Removal Tool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 23 May 2010 22:05:14 +0200
From: Christian Sciberras <uuf6429@...il.com>
To: stuart@...erdelix.net
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: denial-of-service vulnerability in the
	Microsoft Malicious Software Removal Tool

When I am logged in as Admin and try to replace NDIS.SYS, Windows
File Protection replaces it.  Why did WFP fail to protect the file
against Cutwail in the first place, and how can a virus replace
NDIS.SYS using Administrative privs, if I cannot do it myself when
Administrator?

You can't blame anyone for your incompetence, WFP is there to keep your
system running, not acting as an antivirus (today many people seem to think
that antiviruses should be put everywhere, starting from web browsers
themselves!)

If memory serves me right, in your case you just had to delete the file from
WFP cache folder and then the real file. The worst thing to you would be a 5
min search on Google.

Lastly, sure the system (might) be unbootable, but where's the virus?

You can boot into MS Recovery console and repair your system (missing driver
etc) but you can't do an antivirus scan reliably from recovery console; for
one thing such functionality is not available and another, antivirus can't
determine certain kinds of virii since they need to be at least loaded (if
not running) (example; MSI VBS-generic/self-mutating).

Cheers.

On Sun, May 23, 2010 at 9:43 PM, lsi <stuart@...erdelix.net> wrote:

> On 23 May 2010 at 23:57, webDEViL wrote:
>
> > All said and done, that doesn't make it a vulnerability.
>
> Tell that to my customer (wait until I've invoiced them, though).
>
> Stu
>
> ---
> Stuart Udall
> stuart at@...erdelix.dot net - http://www.cyberdelix.net/
>
> ---
>  * Origin: lsi: revolution through evolution (192:168/0.2)
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/