full-disclosure - Re: Windows .ANI LoadAniIcon Stack Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0273B67044957C41BD71D12EBA2E00AE0FD31B@becca.LarrySeltzer.local>
Date: Sun, 1 Apr 2007 17:45:04 -0400
From: "Larry Seltzer" <Larry@...ryseltzer.com>
To: "Dave Aitel" <dave@...unityinc.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Windows .ANI LoadAniIcon Stack Overflow

I'm not familiar with Solar Eclipe's claims. I thought the low-entropy
argument was impeached a while ago. See
http://blogs.msdn.com/michael_howard/archive/2006/10/04/Alleged-Bugs-in-
Windows-Vista_1920_s-ASLR-Implementation.aspx The author of the original
paper arguing low entropy replies to the blog conceding the point. There
are two stages of randomization.

Perhaps your exploit proves this wrong, but it's the last I heard on the
subject. And even if there are only 256 slots how do you try more than
one? Isn't the first wrong one going to crash the browser?

As for the exploits in protected mode I'm sure there are things you can
do, but it's a huge step down from what you can do in XP and it's gone
as soon as you exit IE7

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.eweek.com/blogs/larry%5Fseltzer/
Contributing Editor, PC Magazine
larryseltzer@...fdavis.com 

-----Original Message-----
From: Dave Aitel [mailto:dave@...unityinc.com] 
Sent: Sunday, April 01, 2007 3:42 PM
To: Larry Seltzer
Cc: dev code; full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Windows .ANI LoadAniIcon Stack Overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

ASRL has limited entropy and the attacker can continue to try exploits
an infinite number of times (as Solar Eclipse points out). This means
you can write a reliable Vista exploit, theoretically. I'll probably
finish one up on Monday.

IE in protected mode would still allow you access to the local network
and, more importantly, anything IE does. You could, for example, inject
code into all viewed webpages that steals passwords and whatnot. Just at
the very minimum.

- -dave

Larry Seltzer wrote:
>>> It is completely possible to execute shellcode if we can do some DEP
> bypass (ie. ret2libc attack, etc..)
>
> In Vista this should have problems because of ASLR, right?
>
> I'm beginning to think that web-based attacks with this in Vista 
> aren't really so scary. Even if you can get them to execute what can 
> you really do in IE protected mode? You need to get the user to run 
> the ANI outside of IE. Can anyone say what actually happens if you 
> read an e-mail in the Vista Mail program with an attack ANI embedded?
>
> Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> http://blog.eweek.com/blogs/larry%5Fseltzer/
> Contributing Editor, PC Magazine
> larryseltzer@...fdavis.com
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGEAsYtehAhL0gheoRAutoAJ0QhPsOvcdCTU2dZZgkZYINC3+K3QCdFMQH
UH02qnLi2Gbp07rLWpKv/5w=
=4oC5
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/