T
Test User
On Tue, 17 Jul 2007 13:53:05 -0500
pcbrat <pcbrat@lorettotel.net> wrote:
> Oops! My bad.. sorry. Error is "Stack overflow at line 0:" <--- that
> is the entire context of the error message in Windows Internet
> Explorer Dialog Bos. I don't, nor will I, have any other browsers
> installed on my machine, so I really can't test that. Thank you in
> advance.
>
> -pcbrat
>
>
If I were you, I wouldn't use IE, that overflow is caused by a
programing error causing allocated memory to overflow, you could visit a
malicious website that would be able to feed code to your buffer.
Whenever you see any type of error that's causing mem/stack overflow.
either you patch it, or you don't use it. There is a reason why memory
overflow is the whipping boy of exploits. If you continue to use IE
than, use it at your own risk, don't start whining if your box gets
turned into a zombie.
* Windows Vista
Overview:
Determina Security Research has discovered a vulnerability in the USER32.DLL code responsible for loading animated cursor (.ANI) files. This vulnerability can be exploited by a malicious web page or HTML email message and results in remote code execution with the privileges of the logged-in user. The vulnerable code is present in all versions of Windows up to and including Windows Vista. All applications that use the standard Windows API for loading cursors and icons are affected. This includes Windows Explorer, Internet Explorer, Mozilla Firefox, Outlook and others.
Microsoft fixed a closely related vulnerability with the MS05-002
security update, but their fix was incomplete. Determina Security
Research was able to bypass the MS05-002 patch and develop a
proof-of-concept exploit that works on fully-patched Windows systems.
http://www.determina.com/security.research/vulnerabilities/ani-header.html
pcbrat <pcbrat@lorettotel.net> wrote:
> Oops! My bad.. sorry. Error is "Stack overflow at line 0:" <--- that
> is the entire context of the error message in Windows Internet
> Explorer Dialog Bos. I don't, nor will I, have any other browsers
> installed on my machine, so I really can't test that. Thank you in
> advance.
>
> -pcbrat
>
>
If I were you, I wouldn't use IE, that overflow is caused by a
programing error causing allocated memory to overflow, you could visit a
malicious website that would be able to feed code to your buffer.
Whenever you see any type of error that's causing mem/stack overflow.
either you patch it, or you don't use it. There is a reason why memory
overflow is the whipping boy of exploits. If you continue to use IE
than, use it at your own risk, don't start whining if your box gets
turned into a zombie.
* Windows Vista
Overview:
Determina Security Research has discovered a vulnerability in the USER32.DLL code responsible for loading animated cursor (.ANI) files. This vulnerability can be exploited by a malicious web page or HTML email message and results in remote code execution with the privileges of the logged-in user. The vulnerable code is present in all versions of Windows up to and including Windows Vista. All applications that use the standard Windows API for loading cursors and icons are affected. This includes Windows Explorer, Internet Explorer, Mozilla Firefox, Outlook and others.
Microsoft fixed a closely related vulnerability with the MS05-002
security update, but their fix was incomplete. Determina Security
Research was able to bypass the MS05-002 patch and develop a
proof-of-concept exploit that works on fully-patched Windows systems.
http://www.determina.com/security.research/vulnerabilities/ani-header.html