lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20041017042085.SM01312@server>
From: Admin at SecureTarget.Net (Kaveh Mofidi)
Subject: Microsoft Windows Huge Text Processing Instability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
Secure Target Network (Security Advisory October 17, 2004)
Topic: Microsoft Windows Huge Text Processing Instability
Discovery Date: October 14, 2004
Link to Original Advisory: http://securetarget.net/advisory.htm
 
Affected applications and platforms:
Notepad, NotePad2 and MetaPad (Seems like all Text Processing Apps) /
Microsoft Windows (All Versions)
 
Introduction:
It is not important, the limitation of opening large text file with
"notepad" or similar products like NotePad2
(http://www.flos-freeware.ch) and MetaPad
(http://liquidninja.com/metapad/); the point is just the way these
tiny text processing apps open and handle large text files (talking
about over the 200MB).
The way they handle huge text files, it is near possible for a fast
modern PC to be completely unstable. This Instability may path to
process injection because you cannot even kill the processes of these
apps and they will remain "up and running" even when you logged off.
So, it's possible for a unprivileged user to simply hook to the
remaining process of a privilege user and this lead to information
disclosure (simply reading the content of the memory before swapping
a large file which happens time after time, based on the file size)
but may even lead to running privileged tasks based on the app they
used for processing text.
 
Exploit:
It is different to exploit based on the application you choose for
text processing; for windows default notepad.exe, it'll be some like
a huge DoS but for NotePad2.exe and MetaPad.exe it is possible to
doing process injection (information disclosure and/or running
privileged tasks).
 
Workaround:
The best way to work around this situation is just not to open large
text files in windows! or wait a long time for completion of task.
 
Tested on:
Microsoft Windows XP SP1/SP2RC2/SP2 on Intel P4 2.4 with 1GB of RAM
 
Feedback:
Kaveh Mofidi 
Head of Secure Target Network
HTTP://SECURETARGET.NET
 
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0.2
 
iQA/AwUBQXIoAmO1siv41icpEQKOOQCgx/NNYad1GNBZizskyeNoaRHA4WcAoMVY
legdMSdcweVoBm0jbSxPsEaq
=AIzi
-----END PGP SIGNATURE-----

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041017/d8cf9dce/attachment.html

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ