[35583] in bugtraq
THE INSIDER VULNERABILITY STILL WORKS AFTER TODAY'S PATCH
daemon@ATHENA.MIT.EDU (liudieyu@umbrella.name)
Sat Jul 3 13:16:17 2004
Message-Id: <200407030128.i631SQF1017289@web170.megawebservers.com>
To: <bugtraq@securityfocus.com>, <NTBugtraq@listserv.ntbugtraq.com>,
<full-disclosure@lists.netsys.com>
Date: Sat, 3 Jul 2004 01:28:26 -0000
From: <liudieyu@umbrella.name>
FROM: Liu Die Yu - http://umbrella.name/
TO : bugtraq@securityfocus.com, NTBugtraq@listserv.ntbugtraq.com,
full-disclosure@lists.netsys.com
SUBJ: THE INSIDER VULNERABILITY STILL WORKS AFTER TODAY'S PATCH
DATE: 2004/07/03 UTC+800
BODY:
[background]
the latest 0day remote compromise exploit for internet explorer was found
being used in the wild. :-)
"the-insider" exploit was first noticed by the-insider:
http://umbrella.name/iebug.com/display-singlemessage.php?readmsg:fulldisclosure_message-2004060050
and then documented by jelmer:
http://umbrella.name/iebug.com/display-singlemessage.php?readmsg:fulldisclosure_message-2004060124
http://62.131.86.111/analysis.htm
microsoft just released:
Critical Update for Microsoft Data Access Components - Disable ADODB.Stream
object from Internet Explorer (KB870669)
http://www.microsoft.com/downloads/details.aspx?FamilyID=4D056748-C538-46F6-B7C8-2FBFD0D237E3&DisplayLang=en
which kills the old exploit.
[FIX FOR THE PATCH]
use Shell.Application instead.
[service]
both "attack service"(finding bugs) and "defense service"(securing systems):
http://umbrella.name/
[greetings]
malware( http://www.malware.com/ ) who found Shell.Application.
[signature]
LIUDIEYU
liudieyu AT umbrella . name
