full-disclosure - Microsoft's Explorer and Internet Explorer long share name buffer overflow.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: psz at maths.usyd.edu.au (Paul Szabo)
Subject: Microsoft's Explorer and Internet Explorer long share name buffer overflow.

Tested on W2kSP4 (right-click MyComputer, Properties):

  Microsoft Windows 2000
  5.00.2195
  Service Pack 4

with IE6 (and noting that W2kSP3 behaved identically).

Going to  StartMenu > Run > \\hostname  behaves sensibly, showing all
shares; clicking on the long one says "The network name cannot be found".

However, going to  StartMenu > Run > \\IP.address  crashes explorer:

  Program Error
  explorer.exe has generated errors and will be closed by Windows.
  You will need to restart the program.
  An error log is being created.
  [Cancel]

(then explorer re-starts automatically and the button changes to [OK]). I
cannot see an EIP=41414141 (or 00410041) in file drwtsn32.log (in
C:\Documents and Settings\All Users\Documents\Dr Watson), but maybe it is
not telling the truth (or maybe I needed \\IP.address\sharename?).

Anyway, http://support.microsoft.com/?kbid=322857 lies when it says this is
fixed in W2kSP4; or maybe that KB article refers to a different problem: it
say the error should be "Access Violation", I got "Program Error".

Cheers,

Paul Szabo - psz@...hs.usyd.edu.au  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia