bugtraq - Re: [HV-HIGH] Microsoft Jet DB engine vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 31 Mar 2005 16:53:03 -0800
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: <bugtraq@...urityfocus.com>
Subject: Re: [HV-HIGH] Microsoft Jet DB engine vulnerabilities

How is this a high-level vulnerability when a user must launch the file, 
simply resulting in possible code execution within that user's interactive 
credentials?  If you're going to get them to launch a file, why not code up 
a nice juicy .exe for them and not bother with the other stuff?

Or even better, since it's an MDB file, code it up in an Access module- that 
way it won't even throw an exception.

A bug, yes- a security vulnerability, no.

----- Original Message ----- 
From: <vuln@...view.com>
To: <full-disclosure@...ts.grok.org.uk>; <bugtraq@...urityfocus.com>
Sent: Thursday, March 31, 2005 1:53 PM
Subject: [HV-HIGH] Microsoft Jet DB engine vulnerabilities

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Microsoft Jet DB engine vulnerabilities
>
> Classification:
> ===============
> Level: low-med-[HIGH]-crit
> ID: HEXVIEW*2005*03*31*1
> URL: http://www.hexview.com/docs/20050331-1.txt
>