On 4/1/07, <b class="gmail_sendername">wac</b> <<a href="mailto:waldoalvarez00@gmail.com">waldoalvarez00@gmail.com</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br><br><div><span class="q"><span class="gmail_quote">On 4/1/07, <b class="gmail_sendername">Larry Seltzer</b> <<a href="mailto:Larry@larryseltzer.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
Larry@larryseltzer.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
>>The issue is that this only works with DEP turned off!<br><br>Interesting point. I haven't seen this mentioned anywhere, including the<br>Microsoft advisory<br>(<a href="http://www.microsoft.com/technet/security/advisory/935423.mspx" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://www.microsoft.com/technet/security/advisory/935423.mspx</a>).<br><br>Has anyone actually tested this with DEP on/off to be sure?</blockquote></span></div></blockquote><div><br>Did you guys see this from the CISRT.
<br><br><a href="http://www.cisrt.org/enblog/read.php?68">http://www.cisrt.org/enblog/read.php?68</a><br><br><br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div>Yes, winhex uses the function when you open the .ani and I don't have it running with DEP turned on and the same goes for firefox that also leaves the file openend when I openen web link dev sent me (already tested winhex with the address of exitprocess that btw seems to float around from system to system since the version dev sent me does not works for me and it works like a charm when I built it). I was talking with dev code about DEP bypassing btw, we think that is possible to exploit even with >> DEP ON <<. Just ideas for now.
<br></div><span class="q"><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Larry Seltzer<br>eWEEK.com Security Center Editor<br><a href="http://security.eweek.com/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://security.eweek.com/</a><br><a href="http://blog.eweek.com/blogs/larry_seltzer/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://blog.eweek.com/blogs/larry_seltzer/</a><br>Contributing Editor, PC Magazine
<br><a href="mailto:larryseltzer@ziffdavis.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">larryseltzer@ziffdavis.com
</a><br><br>_______________________________________________<br>Full-Disclosure - We believe in it.<br>Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://lists.grok.org.uk/full-disclosure-charter.html
</a><br>Hosted and sponsored by Secunia - <a href="http://secunia.com/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://secunia.com/</a><br></blockquote></span></div><br>
<br>_______________________________________________<br>Full-Disclosure - We believe in it.<br>Charter: <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://lists.grok.org.uk/full-disclosure-charter.html" target="_blank">
http://lists.grok.org.uk/full-disclosure-charter.html</a><br>Hosted and sponsored by Secunia - <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://secunia.com/" target="_blank">http://secunia.com/</a><br>
</blockquote></div><br>