full-disclosure - Re: new internet explorer exploit (was new worm)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: Re: new internet explorer exploit  (was new worm)

Void <void@...t.net> wrote:

> Just wanted to add that Norton Anti-Virus 2004 will detect this exploit and 

Of course, what you mean is "this specific exploit".

You wouldn't -- unlike the snake-oilers at Symantec (and many other AV 
companies) -- want to imply that its detection of the specific exploit 
instance you tested (i.e. using Jelmer's example) is any kind of 
indication of NAV's (etc...) detection of any and all possible exploits 
of this vulnerability now, would you??

> pop up a warning, but also fails to halt its execution or protect the user 
> in any way.

Oh joy...

> Here is what it thinks it is:
> 
> http://securityresponse.symantec.com/avcenter/venc/data/bloodhound.exploit.6.html
> 
> So there is some measure of warning, but no real protection.

You mean, of course, "there is some level of warning against sonme 
unknown portion (perhaps as small a one over ininfity) of possible 
exploits of this vulnerability".

I guess the handy thing, at least historically, is that the dweebs that 
have used such things in their viruses and worms have tended to copy 
the PoC examples as near as damnit to the letter, so have tended to be 
prematurely detected.

Of course, _this_ exploit was discovered, analysed and somewhat fully 
documented by the likes of "http-equiv" and Jelmer _AFTER_ it had been 
discovered by someone else, not publicized and then used in a rather 
"successful" worm.  So maybe the writer of that worm is not one of your 
typical skiddie types and the number of not publicly known functional 
exploits of this vuln that are not detected by NAV, etc is worrying 
higher than usual?

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854