[Full-disclosure] Windows .ANI LoadAniIcon Stack Overflow

[wac]

On 4/1/07, Larry Seltzer <Larry at larryseltzer.com> wrote:
>
> >>The issue is that this only works with DEP turned off!
>
> Interesting point. I haven't seen this mentioned anywhere, including the
> Microsoft advisory
> (http://www.microsoft.com/technet/security/advisory/935423.mspx).
>
> Has anyone actually tested this with DEP on/off to be sure?


Yes, winhex uses the function when you open the .ani and I don't have it
running with DEP turned on and the same goes for firefox that also leaves
the file openend when I openen  web link dev sent me (already tested winhex
with the address of exitprocess that btw seems to float around from system
to system since the version dev sent me does not works for me and it works
like a charm when I built it). I was talking with dev code about DEP
bypassing btw, we think that is possible to exploit even with >> DEP ON <<.
Just ideas for now.

Larry Seltzer
> eWEEK.com Security Center Editor
> http://security.eweek.com/
> http://blog.eweek.com/blogs/larry_seltzer/
> Contributing Editor, PC Magazine
> larryseltzer at ziffdavis.com
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070401/7bc06b24/attachment.html