lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 21 Dec 2006 14:58:17 +0300
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: full-disclosure@...ts.grok.org.uk
Cc: bugtraq@...urityfocus.com
Subject: Microsoft Windows XP/2003/Vista memory corruption
	0day

Dear full-disclosure@...ts.grok.org.uk,

  Since  it's  already  wide  spread on the public forums and exploit is
  published  on  multiple  sites and there is no way to stop it, I think
  it's time to alert lists about this.

  On the one of Russian forums:
  http://www.kuban.ru/forum_new/forum2/files/19124.html
  message  was  published  by  NULL  about  vulnerability  in Windows on
  processing   MessageBox()   with   MB_SERVICE_NOTIFICATION   flag  and
  message/caption  beggining with \??\. Vulnerability seems to be memory
  corruption  in  kernel  and  causes  system  crash  or  hang after few
  attempts.  It  seems  to happen because message is logged to event log
  and may point to some problem with event logs processing.

  Vulnerability details and code may be found here:
  http://www.security.nnov.ru/Gnews944.html

  There  is  potential  remote  exploitation vector if some service uses
  user-supplied  input  for  MessageBox() function. Messenger service is
  not  vulnerable  in  this way, because it prepends user-supplied input
  with additional string.

  I contacted Microsoft on this issue on December, 16.

-- 
http://www.security.nnov.ru
         /\_/\
        { , . }     |\
+--oQQo->{ ^ }<-----+ \
|  ZARAZA  U  3APA3A   } You know my name - look up my number (The Beatles)
+-------------o66o--+ /
                    |/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists