Full Disclosure mailing list archives

Previous By Date Next
Previous By Thread Next

Re: KeePass version 2.12 <= Insecure DLL Hijacking Vulnerability (dwmapi.dll)

From: Christian Sciberras <uuf6429 () gmail com>
Date: Thu, 9 Sep 2010 00:40:57 +0200
http://support.microsoft.com/kb/2264107

That is installed both in my win7 64bit workstation system and the
32bit XP Pro (virtualized) system.
For the matter, that POC never worked on my PC, at least their initial
implementation was always flawed.
(speaking of which, did they really have to fail it when my own POC,
written under an hour, worked perfectly?)

If you still think my POC was wrong, please do try it and highlight
what is wrong with it.
Though I take no offense in no one trying it - it was more of personal
satisfaction than real use, hence it being written in Lazarus.

Cheers,
Chris.


On Thu, Sep 9, 2010 at 12:00 AM,  <paul.szabo () sydney edu au> wrote:

Christian Sciberras <uuf6429 () gmail com> wrote:


MS issued a patch quite some time ago.


Would you be able to give a reference to that patch, and comment on
its relationship to the recent

 Microsoft Security Advisory (2269637)
 Insecure Library Loading Could Allow Remote Code Execution
 http://www.microsoft.com/technet/security/advisory/2269637.mspx

?


This "vulnerability" is no more on all of MS's OSes ...
I ... tested ... the vulnerability didn't work).


May I suggest that you tested wrong: I followed

 Online Binary Planting Exposure Test
 http://lists.grok.org.uk/pipermail/full-disclosure/2010-September/076293.html

and it "worked" for me, on my patched-to-the-limit WinXP.

Cheers, Paul

Paul Szabo   psz () maths usyd edu au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Previous By Date Next
Previous By Thread Next

Current thread: