full-disclosure - Re: Funny bugs in Windows Server 2003

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5e9568cb0903301610y28acdae6nf8aaee9416d42eed@mail.gmail.com>
Date: Mon, 30 Mar 2009 19:10:44 -0400
From: Rubén Camarero <rjcamarero@...il.com>
To: exceed@...ja.net, full-disclosure@...ts.grok.org.uk
Subject: Re: Funny bugs in Windows Server 2003

You should clarify that the triggers fot these 31337 non-real security bugs
are "%n" x 1100 and not "%n%n%n..." x 1100 for the lower intelligence crowd
that currently subscribes to this list.

FYI: Microsoft's operating system, Windows, has many format overflows in
_vsprintf() that result in the BSOD when owning kernel drivers.

On Mon, Mar 30, 2009 at 2:13 PM, <exceed@...ja.net> wrote:

> "Cuz they say two thousand zero zero party over - Oops, out of time.
> So tonight I'm gonna party like it's 1999"
>
>  sort.exe %n%n%n... x 1100
>  odbcconf.exe %n%n%n... x 1100
>  locator.exe %n%n%n... x 1100
>  ldifde.exe %n%n%n... x 1100
>  cprofile.exe %n%n%n... x 1100
>  csvde.exe %n%n%n... x 1100
>
> As found on Windows Server 2003 R2 SP2.
>
> I didn't report this to Microsoft, because I am pretty sure they already
> know
> about. Anyhow, this bugs are not _real_ security issues.
>
> Some things never change.
>
>
> /exceed
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

-- 
Rubén Camarero
CCNA, CISSP

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/