bugtraq - Re: First vulnerabilities in the SP2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040818183152.30491.qmail@www.securityfocus.com>
Date: 18 Aug 2004 18:31:52 -0000
From: Matthew Roberts <webmaster@...thew1471.co.uk>
To: bugtraq@...urityfocus.com
Subject: Re: First vulnerabilities in the SP2 - XP ?...

In-Reply-To: <200408180941.16239.radoslav.dejanovic@...us.hr>

>This basically tells the user to open CMD and then execute the attachment in command line. Now, someone has to be really, really dumb to do that.

People might forget that dragging and dropping to a command prompt actually executes the file.

I have 2 words, Batch files.. I did not get prompted when I double clicked a batch file containing one line "Malicious program.exe"

Sp2 did not also detect that Viri.zip downloaded from the internet and contains an EXE inside it...

I am not trying to create bad press for SP2, I personally think very highly of it...

But I do think people will enter the trap "Wel it's gonna alert me if it's not safe ain't it?" I think that's the biggest issue here