bugtraq - RE: Did MS pull an Ilfak? (MS patch bindiff results)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 10 Jan 2006 13:39:28 -0800
From: "Greg Wroblewski" <Greg.Wroblewski@...rosoft.com>
To: "Joe Polk" <listuser.jav@...il.com>,
	"Brett Glass" <brett@...iat.org>
Cc: <bugtraq@...urityfocus.com>
Subject: RE: Did MS pull an Ilfak? (MS patch bindiff results)


The only attack vector we know about for Win9x, ME platforms is through
printing. I'm afraid that "fixing" that would break some functionality.

Greg
------------
This post is provided as is and confers no rights or whatever.

-----Original Message-----
From: Joe Polk [mailto:listuser.jav@...il.com] 
Sent: Tuesday, January 10, 2006 6:21 AM
To: Brett Glass
Cc: bugtraq@...urityfocus.com
Subject: Re: Did MS pull an Ilfak? (MS patch bindiff results)

Brett Glass wrote:

>Question: Is Ilfak's patch still needed for Windows 95, 98, SE and ME
>systems, for which Microsoft is refusing to provide a patch? To what
>extent are these systems vulnerable if not patched?
>
>--Brett Glass
>
>
>  
>
Actually, Ilfak never tested his patch on a Win 9x machine. Steve 
Gibson, however, plans to write a
patch for 95, 98, and ME if Microsoft doesn't.

JP