full-disclosure - Re: [ GLSA 200601-09 ] Wine:Windows MetafileSETABORTPROC vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri Jan 13 22:17:10 2006
From: pferrie at symantec.com (Peter Ferrie)
Subject: Re: [ GLSA 200601-09 ]
	Wine:Windows	MetafileSETABORTPROC vulnerability

Todd Towles:

>>Can anyone else verify Steve Gibson's assertion that this
>>flaw was intentionally placed by Microsoft programmers?

It's insecure-by-design, but it's working exactly as written.
It's been in there for _15_ years, and ported to every version of Windows.
Windows 3.0 supports it. :-/

bkfsec:

>The way I read what he's saying there, he's saying that you enter
>malformed input and that malformed input pushes the executable code into
>position to be executed...

There is no need for malformed input, though.
The description isn't great, since upon return from the function, Windows
will resume parsing the records in the usual way.

8^) p.