lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Dec 2006 16:10:35 +0000
From: "BART. ...." <>
Subject: FW: [Fwd: Re[2]: Fun with event logs

Dear 3APA3A,

Correct me if i am wrong, but it looks like it's documented behavior of the 
event viewer.
This is what i found:

Note that there is no way to log a string that contains %n, where n is an 
integer value. This syntax is used in IPv6 addresses, so it is a problem to 
log an event message that contains an IPv6 address. For example, if the 
message text contains %1, the event viewer treats it as an insertion string. 
If the string contains %%1, the event viewer literally uses %%1.



>-------- Original Message --------
>Subject: 	Re[2]: [Full-disclosure] Fun with event logs (semi-offtopic)
>Date: 	Thu, 21 Dec 2006 20:13:14 +0300
>From: 	3APA3A <3APA3A@...URITY.NNOV.RU>
>Reply-To: 	3APA3A <3APA3A@...URITY.NNOV.RU>
>To: 	Michele Cicciotti <>
>References: 	<> 
>Dear Michele Cicciotti,
>--Thursday, December 21, 2006, 6:20:54 PM, you wrote to 
>>>There  is  interesting  thing  with  event  logging on Windows. The only
>>>security  aspect  of  it  is  event log record tampering and performance
>>>degradation,  but  it may become sensitive is some 3rd party software is
>>>used for automated event log analysis.
>MC> I doubt this. The event logs don't contain the actual formatted
>MC> string, because the template string is localized and only retrieved
>MC> when the entry is displayed - what is logged is just a message id
>MC> and the string inserts (see documentation for EVENTLOGRECORD).
>MC> FormatMessage (which is used to build the full message to display to
>MC> the user) isn't the culprit, either, because it doesn't operate
>MC> recursively (that would have bizarre consequences, since
>As  I  wrote,  my message is semi-offtopic, because it's more fun than
>any  security  vulnerability  here.
>Yes,  probably  this  bug  only  affects  event  viewer  itself. I don't
>understand  how  and why Microsoft achieved this effect in event viewer,
>which  is,  by  the  way,  security tool, and if it's hard for different
>vendor  to  make  same  mistake. It doesn't look like Easter egg, but if
>FormatMessage  does  not recursion it needs to be specially coded and it
>does  nothing  except this bug. Bug, that needs to be specially coded is
>new funny bug category, isn't it?

The MSN Entertainment Guide to Golden Globes is here.  Get all the scoop.

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists