[Full-disclosure] Internet Exploiter 2 - bypassing DEP
berendjanwever at gmail.com
Tue Mar 2 00:40:32 GMT 2010
It seems my English is not as good as I thought and I accidentally led Ryan
Naraine <http://blogs.zdnet.com/security/?p=5573>, Larry
probably others to come to conclusions such as that I released a weaponized
0-day that bypasses both ASLR+DEP in current versions of MSIE and Windows
using a completely new technique and that I did so as a Google employee.
However, let me try to explain better and to correct any ambiguity I may
have created in my first blog post:
- I have recently released an exploit that I developed in 2005 (before I was
employed by either MS or Google).
- I am releasing this as an individual as part of my new-years
dump random stuff from my harddisk onto the tubes. (I have a personal
interest in security outside of my work, every now and then I find enough
time to work on and release stuff like this).
- The exploit targets a bug that was fixed in
that only affected MSIE 6.0 and earlier.
- The exploit shows how to implement the well known ret-into-libc technique
(using a heap spray) to bypass DEP.
- The exploit does not contain anything that is not already public, other
than how to implement a ret-into-libc using a heap-spray to exploit complex
memory corruption bugs such as the DHTML race condition it targets.
- The exploit does not bypass ASLR.
- Using ret-into-libc to bypass DEP affects any application that has a
vulnerability that allows an attacker to use a ret-into-libc attack - this
is not MSIE specific.
I hope this helps clarify some things. But, not being a native English
speaker, I may inadvertently have said things completely wrong again. I look
forward to correcting my mistakes as they show up on other news sites in the
Berend-Jan Wever <berendjanwever at gmail.com>
On Mon, Mar 1, 2010 at 4:51 PM, Berend-Jan Wever
<berendjanwever at gmail.com>wrote:
> Hey all,
> I released a version of my Internet Exploiter 2 exploit from 2005 that
> bypasses DEP. If you are familiar with my Internet Exploiter series of
> exploits and/or are interested in how to use heap-spraying to bypass DEP,
> you may like this:
> Berend-Jan Wever <berendjanwever at gmail.com>
-------------- next part --------------
An HTML attachment was scrubbed...
Full-Disclosure is hosted and sponsored by Secunia.