bugtraq - Re: [Full-disclosure] Unpatched IIS Vulnerabilities / Microsoft July Security Bulletin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CC29A300.39CA%thor@hammerofgod.com>
Date: Mon, 16 Jul 2012 17:54:55 +0000
From: "Thor \(Hammer of God\)" <thor@...merofgod.com>
To: Григорий Братислава <musntlive@...il.com>,
  king cope <isowarez.isowarez.isowarez@...glemail.com>
CC: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
  "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: [Full-disclosure] Unpatched IIS Vulnerabilities / Microsoft
 July Security Bulletin

Right - if you've compromised the server to the point you can alter
directory structures/names, the you've already bypassed the ACLs required
in order to "exploit" the vulnerability that allows you to bypass the
ACLs.  I don't get it.

t




On 7/16/12 10:47 AM, "Григорий Братислава" <musntlive@...il.com> wrote:

>On Mon, Jul 16, 2012 at 1:24 PM, king cope
><isowarez.isowarez.isowarez@...glemail.com> wrote:
>> Hi Lists,
>>
>> it seems Microsoft doesn't want to patch the vulnerabilities I posted
>> back in June,
>> at least not in the July update.
>>
>
>Hello Full Disclosure!! !! !!
>
>Is like to introduce you to Schrödinger's Cat and Wigner's Friend in
>is Computer Security. 'The Wigner's Friend thought experiment posits a
>friend of Wigner who performs the Schrödinger's cat experiment after
>Wigner leaves the laboratory. Only when he returns does Wigner learn
>the result of the experiment from his friend, that is, whether the cat
>is alive or dead. The question is raised: was the state of the system
>a superposition of "dead cat/sad friend" and "live cat/happy friend,"
>only determined when Wigner learned the result of the experiment, or
>was it determined at some previous point?'
>
>http://en.wikipedia.org/wiki/Wigner's_friend
>http://en.wikipedia.org/wiki/Schr%C3%B6dinger%27s_cat
>
>IIS is neither vulnerable or not vulnerable. Is until you is exploit
>it and verify!
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/