bugtraq - Windows 2003 Server - Defeating the stack protection mechanism

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <08b001c37872$a0645280$8d01010a@GLADIUS>
Date: Thu, 11 Sep 2003 15:40:20 +0100
From: "NGSSoftware Insight Security Research" <nisr@...tgenss.com>
To: <bugtraq@...urityfocus.com>, <NTBUGTRAQ@...TSERV.NTBUGTRAQ.COM>,
   <vulnwatch@...nwatch.org>, <full-disclosure@...ts.netsys.com>,
   <vuln-dev@...urityfocus.com>
Subject: Windows 2003 Server - Defeating the stack protection mechanism


For those interested, NGSS has just published a paper describing how to
defeat the mechanism built into Windows 2003 Server to prevent exploitation
of stack based buffer overflow vulnerabilities. Previous work done in this
area presented methods that only worked in highly specific scenarios - the
new methods presented in this paper are generic. The paper can be downloaded
from http://www.nextgenss.com/papers/defeating-w2k3-stack-protection.pdf .
Cheers,
David Litchfield
NGSSoftware Ltd
http://www.nextgenss.com/
+44(0)208 401 0070



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html