bugtraq - MSIE src&name property disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <44519.194.171.240.7.1099914008.squirrel@www.edup.tudelft.nl>
Date: Mon, 8 Nov 2004 12:40:08 +0100 (CET)
From: "Berend-Jan Wever" <skylined@...p.tudelft.nl>
To: full-disclosure@...ts.netsys.com
Cc: bugtraq@...urityfocus.com
Subject: MSIE src&name property disclosure

Hi all,

In response to statements found at
http://news.com.com/Exploit+code+makes+IE+flaw+more+dangerous/2100-1002_3-5439370.html
 "Microsoft is concerned that this new report of a vulnerability in
Internet Explorer was not disclosed responsibly, potentially putting
computer users at risk," the company said in the statement. "We believe
the commonly accepted practice of reporting vulnerabilities directly to a
vendor serves everyone's best interests, by helping to ensure that
customers receive comprehensive, high-quality updates for security
vulnerabilities with no exposure to malicious attackers while the patch
is being developed."

About "responsible disclosure":
The origional vulnerability was found and disclosed by ned. As far as I
know, ned only knew he had found something that crashed MSIE: a bug.
Microsofts concerns would suggest two options:
1) They expect everybody who finds a bug to investigate the issue and act
according to the impact the problem might have on security. I do not think
this is likely to happen unless everybody is required to be a 1337
ubergeek before they are allowed to use MS software. It's a nice goal to
aim for, but not very realistic.
2) You can not talk about your software crashing, ever, unless it's to the
vendor: You might have stumbled upon a vulnerability and if a malicous
attacker hears about it, he might use it.

About "commonly accepted practice of reporting vulnerabilities directly to
a vendor":
When did they arrest all the black-hats ?

About "no exposure to malicious attackers while the patch is being
developed":
Allthough I believe in responsible disclosure of vulnerabilities, it DOES
NOT prevent malicious attackers to discover and exploit the same
vulnerability while a patch is being developed. Resonsible disclosure
decreases the chance of somebody hacking your system while you are
vulnerable, it doesn't make it zero.

Anybody who understands basic bufferoverflow techniques will be able to
write an exploit for this vulnerability. I did it in a few minutes, so how
hard can it be ? I do not feel I disclosed anything new, I just saved a
lot of people the trouble of writing it themselves.

The vulnerability has been rated "extremely critical" since I released the
exploit. I say it was allready "extremely critical" before ned disclosed
his information, only nobody knew it was there. It was "extremely
critical" when ned did, but only a few could grasp that. Then I explained
it was an easy to exploit bufferoverflow, it still did not get much
attention.
Writing the exploit hasn't changed the flaw or it's impact, it just
attracked the right amount of attention to the problem.

Cheers,
SkyLined

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html