lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 21 Dec 2006 16:41:41 +0300
Subject: Re: Microsoft Windows XP/2003/Vista memory
	corruption 0day

Dear lists,

in  another  Russian  forum, Killer{R} made analysis on this issue using
Windows 2000 sources:

The  problem is in win32k.sys' function GetHardErrorText, which tries to
prepare  EXCEPTION  data  for  event  log, and seems to be some very old
debugging feature accidently left in production code since Windows 2000.

In Windows 2000 there is a peace of code like:

} else if ((asLocal.Length > 4) && !_strnicmp(asLocal.Buffer, "\\??\\", 4)) {
strcpy( asLocal.Buffer, asLocal.Buffer+4 );

Killer{R}  assumes  the problem is in strcpy(), because it should not be
used for overlapping buffers, but at least ANSI implementation of strcpy
from  Visual  C  should be safe in this very situation (copying to lower
addresses).  May be code is different for Windows XP or vulnerability is
later in code.

--Thursday, December 21, 2006, 2:58:17 PM, you wrote to

3> Dear,

3>   Since  it's  already  wide  spread on the public forums and exploit is
3>   published  on  multiple  sites and there is no way to stop it, I think
3>   it's time to alert lists about this.

3>   On the one of Russian forums:
3>   message  was  published  by  NULL  about  vulnerability  in Windows on
3>   processing   MessageBox()   with   MB_SERVICE_NOTIFICATION   flag  and
3>   message/caption  beggining with \??\. Vulnerability seems to be memory
3>   corruption  in  kernel  and  causes  system  crash  or  hang after few
3>   attempts.  It  seems  to happen because message is logged to event log
3>   and may point to some problem with event logs processing.

3>   Vulnerability details and code may be found here:

3>   There  is  potential  remote  exploitation vector if some service uses
3>   user-supplied  input  for  MessageBox() function. Messenger service is
3>   not  vulnerable  in  this way, because it prepends user-supplied input
3>   with additional string.

3>   I contacted Microsoft on this issue on December, 16.


Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists