| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <AANLkTinnpO12zDpA0VB+v2DNce_dXoM-Hi4b8+eTH7K4@mail.gmail.com> Date: Thu, 9 Sep 2010 01:44:33 +0200 From: Christian Sciberras <uuf6429@...il.com> To: paul.szabo@...ney.edu.au Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: Re: KeePass version 2.12 <= Insecure DLL Hijacking Vulnerability (dwmapi.dll) That is what others said, yet it installed automatically on mine. The only interaction was that I allowed it to be downloaded and installed....not really geeky at all... I must say you'll have to take my word on it. On Thu, Sep 9, 2010 at 1:36 AM, <paul.szabo@...ney.edu.au> wrote: > Christian Sciberras <uuf6429@...il.com> wrote: > >>>> MS issued a patch quite some time ago. >> http://support.microsoft.com/kb/2264107 > > That is not a "patch", not installed by default: is only for > uber-geeks who manually install it. Was issued a week ago, in > response to this kerfuffle, not "quite some time ago". > > Which setting of CWDIllegalInDllSearch did you choose: was it > 0xFFFFFFFF which may be "safe", but is known to break Outlook > (and others), as noted in > > DLL hijacking vulnerabilities > http://isc.sans.edu/diary.html?storyid=9445 > > (geeks can add further tweaks to the registry to fix). > > Cheers, Paul > > Paul Szabo psz@...hs.usyd.edu.au http://www.maths.usyd.edu.au/u/psz/ > School of Mathematics and Statistics University of Sydney Australia > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists