full-disclosure - Re: It's not that simple...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87vf23yggn.fsf@mid.deneb.enyo.de>
Date: Thu Aug 18 06:14:47 2005
From: fw at deneb.enyo.de (Florian Weimer)
Subject: Re: It's not that simple...

* Jason Coombs:

> Kurt Seifried wrote:
>> Actually it really is that simple. Disabling Null sessions is
>> entirely possible, quite easy, and doesn't break a lot (at least in
>> my previous
>
> Then why doesn't Microsoft provide these instructions in the workarounds 
> section of the vulnerability announcement?

Attacks using proper accounts are still possible, AFAIK.  These days,
it's hard to explain such fine points in advisories because all the
useful details have been eliminated and vendors fear to give away too
much information.  In the present case, it didn't help to delay the
exploit, of course.

> I'm supposed to do Microsoft's job for them? No way.

Well, it's your computers that are potentially compromised, not
theirs.