full-disclosure - MS03-032 Patch Updated or NOT ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: MS03-032 Patch Updated or NOT ?

Elv1S <elvi52001@...oo.com> wrote:

> on MS website, the security bulletin MS03-032 was updated on sept 8 :
> 
> V1.3 (September 8, 2003): Added information regarding reports that the
> patch provided does not properly correct the Object Type Vulnerability
> (CAN-2002-0532) 
> 
> But after applying the patch, rebooting - and making a test on k-otik :
>  
> http://www.k-otik.com/MS03-032-TEST/
> http://www.k-otik.com/MS03-032-TEST2/
>  
> i'm still vulnerable !!!
>  
> So updated or not ??

Not.

Had you read a little more carefully you may have noted the third paragraph of the updated bulletin, which reads, in its entirety:

   Microsoft is investigating these reports and will re-issue this
   bulletin with an updated patch that corrects these problems.

Regards,

Nick FitzGerald