 |
| |
|
| |
|
|
Urban Ranger
|
|
Apolyton Duke of Off-Topic
|
|
quote:
Originally posted by Asher
In addition to only affecting systems without NX/XD support ("software" DEP/"sandboxing" instead of "hardware"), it'll also require an exploitable memory error in a system component (there are none known right now) that uses a very specific method of heap allocation, including using heap lookaside lists (which are disabled by default). |
The NX support just gives people a false sense of security.
quote:
Originally posted by Asher
In short,  . The chances of this being an issue are slim to none, and it's more FUD from the people who claim to hate FUD.  |
Heard about "smashing the stack" before? Buffer overruns is the single most critical thing to guard against. I wonder why the resident MS fanboy is downplaying this? 
quote:
Originally posted by Asher
You'd think the Linux geeks who keep buzzing about this would best spend their time upgrading their linux boxes. |
The funny thing is, updating to SP2 does little good.
Yet what are making the CERT list? 
quote:
Originally posted by Asher
It's front-page news when MS announces a few vulnerabilities, and it slips into obscurity when there's 17 Linux Kernel vulnerabilities recently... |
It's so amusing that MS types are telling us that how Windows is so much more secure than Linux, but even the vaulted SP2 is breached so fast, which enables buffer overruns of all things. "Trustworthy Computing" indeed.
Besides, MS failed to announce this, like usual.
|
|
| |
|
|
|
Asher
|
 |
Calgary, Alberta
Nov 1999
time: 22:29
|
|
So does using Linux or MacOS X, or anything where people tell you you need not worry about viruses.
What's interesting, and what my point was, was that NX/CD does prevent this kind of attack. In fact, this attack just does not work with NX-enabled systems. So saying it gives people a false-sense of security is rather irrelevant...
quote:
Heard about "smashing the stack" before? Buffer overruns is the single most critical thing to guard against. I wonder why the resident MS fanboy is downplaying this? |
Where am I downplaying buffer overruns? 
This exploit is possible on only non-NX systems, and only in a tiny fraction of possible buffer overrun exploits. That is my point.
And yes, I know about smashing the stack...and I apparently know more about it than you -- this exploit has nothing to do with the stack, it's a heap exploit (specifically when heap lookaside is on).
I can also lecture you on dtors, global offset table exploits, polymorphic shellcode, RST hijacking, and FMS attacks if you wish. For all the **** you guys give my university, you need to realize it is the only university with a hacking & virus writing course. I know more about this stuff than you, and more than you think.
What point is it that you're trying to make?
The Linux kernel has 17 recent security vulnerabilities...some of which are remote, not local. When was the last time we even saw a Windows kernel vulnerability? In fact, that's an exercise up to the reader. Show me the last Windows NT kernel vulnerability...
quote:
It's so amusing that MS types are telling us that how Windows is so much more secure than Linux, but even the vaulted SP2 is breached so fast, which enables buffer overruns of all things. "Trustworthy Computing" indeed. |
A system with one remote exploit like any one of the latest 17 Linux kernel vulnerabilies is just as insecure as a system with 150.
I don't expect you to understand, you're clearly the Slashdot type who don't know much about the subject. You have a vague high-level understanding, add on your bias and twist and FUD and suddenly it's just pathetic.
This issue has such a remote chance of happening that it's rather worthless. It's an incredibly contrived example that it's useless in the real world, and one that will likely be patched soon.
|
|
| |
|
|
|
optimus2861
|
|
Halifax, NS
Nov 2000
time: 01:29
|
|
quote:
Originally posted by Asher
The Linux kernel has 17 recent security vulnerabilities...some of which are remote, not local. When was the last time we even saw a Windows kernel vulnerability? In fact, that's an exercise up to the reader. Show me the last Windows NT kernel vulnerability... |
This is a slightly unfair comparison. The WindowsXP kernel has effectively been frozen for -- how long since it came out, three years now? The Linux kernel, specifically the 2.6 kernel, is being continually developed. And the deep hooks between that blasted Internet Explorer and the rest of Windows renders a kernel vulnerability somewhat irrelevant on a Windows box. You hardly need a kernel vulnerability when IE is such a piece of garbage.
At least the Linux 2.2 kernel is still actively maintained; if there were any new NT kernel vulnerabilites found, MS wouldn't fix it any more (I literally mean WindowsNT here, as it's fallen out of support. Hell, MS even gives Windows2000 the shaft to an extent, refusing to backport IE6 SP2 to it for instance).
That being said, I had to download a complete set of KDE 3.2 packages for Mandrake 10.1 for the fifth time last night, and that distro is barely three months old. Meanwhile the KDE developers are working on a beta of 3.4! Seems to me like they're racing ahead on features too much and neglecting security. And I can't get the latest Mandrake kernel to install either -- the bootloader script is crapping out for some obscure reason (and for which I've gotten no advice in two user forums either).
Neither camp is as good as it should be.
|
|
| |
|
|
|
Asher
|
|
Calgary, Alberta
Nov 1999
time: 22:29
|
|
quote:
Originally posted by optimus2861
This is a slightly unfair comparison. The WindowsXP kernel has effectively been frozen for -- how long since it came out, three years now? The Linux kernel, specifically the 2.6 kernel, is being continually developed. And the deep hooks between that blasted Internet Explorer and the rest of Windows renders a kernel vulnerability somewhat irrelevant on a Windows box. You hardly need a kernel vulnerability when IE is such a piece of garbage. |
Don't use IE.
quote:
At least the Linux 2.2 kernel is still actively maintained; if there were any new NT kernel vulnerabilites found, MS wouldn't fix it any more (I literally mean WindowsNT here, as it's fallen out of support. |
Eh? Windows NT 4.0 still gets critical security vulnerabilities patched. The latest was on January 17, 2005...: http://www.computerweekly.com/artic...Search=&nPage=1
Support "officially" ended Dec 31, 2004, but critical patches are still being made available.
As for it being unfair -- it doesn't really matter. The XP kernel was modified as recently as Windows XP SP2, and the Windows XP kernel is from 2001. Many of the kernel vulnerabilities in my list affect 2.2, which predates Windows XP by over a year.
NT4 was launched in, what, 1995/1996? And it's still getting fixes ~10 years later?
Apple won't even provide fixes for anything older than a couple years, and I don't know if I've seen a recent Linux 1.x security fix.
|
|
| |
|
|
|
Asher
|
|
Calgary, Alberta
Nov 1999
time: 22:29
|
|
Looks like this is officially nothing but hysteria and FUD from Urban Ranger, as per usual.
http://news.com.com/Microsoft+SP2+s...ml?tag=nefd.top
quote:
Microsoft: SP2 shimmy's not a flaw
Published: February 1, 2005, 3:24 PM PST
By Matt Hines
Staff Writer, CNET News.com
Microsoft downplayed the significance of a reported flaw in its latest update to Windows XP.
Responding to a Russian security company's claim that it found a way to beat a protective element of Microsoft's Windows XP Service Pack 2, the software giant on Tuesday said it does not believe the issue represents a vulnerability. In fact, the company said the technology highlighted by Moscow-based Positive Technologies was never meant to be "foolproof" and added that the reported flaw does not, by itself, put consumers at risk.
"An attacker cannot use this method by itself to attempt to run malicious code on a user's system," Microsoft said in a statement. "There is no attack that utilizes this, and customers are not at risk from the situation."
Last week, Positive reported that the Data Execution Protection tools included in Service Pack 2--code intended to prevent would-be attackers from inserting malicious programs into a PC's memory--opened Windows XP systems up to additional threats. The security company said that two minor mistakes in the implementation of the technology could allow a knowledgeable programmer to sidestep the measures, known as the Data Execution Protection and the Heap Overflow Protection.
But Microsoft representatives disagreed with Positive's interpretation of Data Execution Protection, saying the technology was not created to necessarily foil existing threats but to make developing attacks against Service Pack 2 harder.
In an e-mail message to CNET News.com, Microsoft representatives said the company would continue to modify the technology and would evaluate ways to mitigate the reported method of bypass.
Those "security technologies in Windows XP Service Pack 2 are meant to help make it more difficult for an attacker to run malicious software on the computer as the result of a buffer-overrun vulnerability," the representatives said in the statement. "Our early analysis indicates that this attempt to bypass these features is not security vulnerability."
Positive said that attack programs that use the exploit to get around Windows XP Service Pack 2 protections work reliably, allowing intruders to introduce malicious code onto machines using a second vulnerability that would otherwise not work on Service Pack 2 because of the protection mechanisms.
Yury Maksimov, chief technology officer at the security company, said Positive only publicized the issue after Microsoft refused to act on previous warnings of the flaw that it sent to the software giant. He said he believes the Data Execution Protection does open up potential vulnerabilities.
"In this situation, we decided it would be much safer for the industry to be aware of the new, existing threat," Maksimov wrote in an e-mail. "Such a vulnerability cannot cause a new worm or virus (to appear). But that's exactly the situation when it is much better to know about the problem, than not."
However, at least one industry expert said that Positive's report of the threat may not be completely fair to Microsoft. Peter Lindstrom, a research director at Spire Security, observed that the Data Execution Protection vulnerability is unlikely to be seized upon by hackers. It relates more to core security issues with the design of many different kinds of software, not just tools made by Microsoft, he said.
"Maybe you could classify this problem as a lost opportunity on Microsoft's part to protect Windows better, but that doesn't make it a vulnerability," Lindstrom said. |
Funny how UR is ignoring this thread now. 
Last edited by Asher on 03-02-2005 at 00:16
|
|
| |
All times are GMT. The time now is 05:29.
Apolyton Time is 00:29. |
top of page
|
|
|
Forum Rules:
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
|
HTML code is ON
vB code is ON
Smilies are ON
[IMG] code is ON
|
|
|
|
|
|
31-01-2005 13:52
|