[36955] in bugtraq
Re: [VulnWatch] CORE-2004-0802: IIS NNTP Service XPAT Command
daemon@ATHENA.MIT.EDU (wirepair)
Fri Oct 15 17:18:48 2004
From: "wirepair" <wirepair@roguemail.net>
To: CORE Security Technologies Advisories <advisories@coresecurity.com>,
Bugtraq <bugtraq@securityfocus.com>, NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM,
Vulnwatch <vulnwatch@vulnwatch.org>
Date: Tue, 12 Oct 2004 16:43:38 -0800
Message-ID: <web-38760171@gator.darkhorse.com>
In-Reply-To: <416C2711.4080407@coresecurity.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 8bit
You missed the SEARCH IN <request> vector. I believe it calls the same heap alloc from STATXMEM.dll
I was having some issues with the string becoming unicoded, but just yesterday I got an ascii overwrite
(in the debugger only tho :/). Oh well looks like you snuffed the bug I was
working on in the process :). Obviously MS fixed this bug in the recent patch. Another thing to note,
when requesting ('s I noticed that an internal function was matching my ( with a ) since they were using
lstrcpy it totally smashed the heap structures when it became unicode'd. But they appeared to fix that as well.
-wire
On Tue, 12 Oct 2004 15:48:49 -0300
CORE Security Technologies Advisories <advisories@coresecurity.com> wrote:
> Core Security Technologies Advisory
> http://www.coresecurity.com
>
> IIS NNTP Service XPAT Command Vulnerabilities
>
>
>
--
Visit Things From Another World for the best
comics, movies, toys, collectibles and more.
http://www.tfaw.com/?qt=wmf
