full-disclosure - Re: COM Server-Based Binary Planting Proof OfConcept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <E9F992AC0BC14453B18B3A3050438734@acros.si>
Date: Thu, 2 Jun 2011 17:42:20 +0200
From: "ACROS Security Lists" <lists@...os.si>
To: "'Dan Kaminsky'" <dan@...para.com>,
	<security@...ossecurity.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: COM Server-Based Binary Planting Proof
	OfConcept

It would hardly be worth mentioning otherwise.

Cheers,
Mitja

> -----Original Message-----
> From: full-disclosure-bounces@...ts.grok.org.uk 
> [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf 
> Of Dan Kaminsky
> Sent: Thursday, June 02, 2011 5:36 PM
> To: security@...ossecurity.com
> Cc: si-cert@...es.si; full-disclosure@...ts.grok.org.uk; 
> bugtraq@...urityfocus.com; cert@...t.org
> Subject: Re: [Full-disclosure] COM Server-Based Binary 
> Planting Proof OfConcept
> 
> Does this run code without prompting, on a reasonably default 
> configuration?
> 
> On Thu, Jun 2, 2011 at 7:52 AM, ACROS Security Lists 
> <lists@...os.si> wrote:
> >
> > We published a remote/local proof of concept for the COM 
> Server-Based 
> > Binary Planting exploit presented at the Hack in the Box 
> conference in Amsterdam.
> >
> > Feel free to try it out online if WebDAV works through your 
> firewall, 
> > or download it and test it in your local network or simply 
> on your computer.
> >
> > 
> http://blog.acrossecurity.com/2011/06/com-server-based-binary-planting
> > -proof.html
> > or
> > http://bit.ly/iSxHKO
> >
> > Best regards,
> >
> > Mitja Kolsek
> > CEO&CTO
> >
> > ACROS, d.o.o.
> > Makedonska ulica 113
> > SI - 2000 Maribor, Slovenia
> > tel: +386 2 3000 280
> > fax: +386 2 3000 282
> > web: http://www.acrossecurity.com
> >
> > ACROS Security: Finding Your Digital Vulnerabilities Before 
> Others Do
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/