bugtraq - RE: BAD NEWS: Microsoft Security Bulletin MS03-032

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0309091413040.19314-100000@pungent.org>
Date: Tue, 9 Sep 2003 14:17:33 -0600 (MDT)
From: Nathan Wallwork <owen@...gent.org>
To: Drew Copley <dcopley@...e.com>
Cc: ADBecker@...ortgage.com, "'GreyMagic Software'" <security@...ymagic.com>,
   "'Bugtraq'" <bugtraq@...urityfocus.com>, <full-disclosure@...ts.netsys.com>,
   <http-equiv@...ite.com>, "'NTBugtraq'" <NTBUGTRAQ@...TSERV.NTBUGTRAQ.COM>,
   "'Microsoft Security Response Center'" <secure@...rosoft.com>,
   <vulnwatch@...nwatch.org>
Subject: RE: BAD NEWS: Microsoft Security Bulletin MS03-032

On Mon, 8 Sep 2003, Drew Copley wrote:
> The only sure way to detect this, I already wrote about [to Bugtraq]. That
> is by setting a firewall rule which blocks the dangerous mimetype string
> [Content-Type: application/hta]. Everything else in the exploit can change. 

Just so we are clear, the firewall wouldn't tbe he right place to catch 
this because that string could be split by packet fragmentation, so you'd 
need to look for it at an application level, after the data stream 
has been reassembled.  

Of course, if anyone thinks it is easier to protect their browser with a 
proxy than fix the browser they've got other issues.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html