full-disclosure - MDaemon NOT vulnerable .. sorry for the advisory.. QBik Wingate is vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <140699598.20060607123640@Zoller.lu>
Date: Wed Jun  7 11:37:04 2006
From: Thierry at Zoller.lu (Thierry Zoller)
Subject: MDaemon NOT vulnerable .. sorry for the
	advisory.. QBik Wingate is vulnerable

Dear kcope,

Under windows the heap structure changes when a debugger is attached,
which may lead to an exploitable condition even when the condition is
not there without debugger.

There was a recent post on DailyDave about this "phenomena"
http://www.immunitysec.com/pipermail/dailydave/2005-October/002585.html

QUOTE :
Also newer versions of windbg can be configured to prevent this:
"Processes created by the debugger behave slightly differently than they
would under normal conditions. Instead of using the standard heap API,
processes created by the debugger use a special *debug heap*. On Microsoft(r)
Windows XP and later versions of Windows, you can force a spawned process to
use the standard heap instead of the debug heap by using the

-- 
http://secdev.zoller.lu
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45  2E57 28B3 75DD 0AC6 F1C7