One new feature of “Web 2.0″, the movement to build a more responsive Web, is the utilization of XML content feeds which use the RSS and Atom standards. These feeds allow both users and Web sites to obtain content headlines and body text without needing to visit the site in question, basically providing users with a summary of that sites content. Unfortunately, many of the applications that receive this data do not consider the security implications of using content from third parties and unknowingly make themselves and their attached systems susceptible to various forms of attack.
Read the rest of this entry »

• 0 Comments

Microsoft Windows Vista, like previous versions, supports animated mouse pointer. The animated mouse pointers are loaded from .ANI files by the functions from USER32.DLL called LoadCursorIconFromResource and LoadCursor. These functions use an internal function called _LoadCursorIconFromFileMap which, under certain conditions, is prone to a buffer overflow
Read the rest of this entry »

• 0 Comments

This paper presents several methods of bypassing the protection mechanism built into Microsoft’s Windows 2003 Server that attempts to prevent the exploitation of stack based buffer overflows. Recommendations about how to thwart these attacks are made where appropriate. Introduction Microsoft is committed to security. I’ve been playing with Microsoft products, as far as security is concerned, since 1997 and in the past year and a half or two I’ve seen a marked difference with some very positive moves made. In a way they had to. With the public relations crisis caused by worms such as Code Red Microsoft needed to do something to stem the flow of customers moving away from the Windows OS to other platforms.
Read the rest of this entry »

• 0 Comments

Despite previous efforts in auditing software manually and automatically, buffer overruns are still being discovered in programs in use. A dynamic bounds checker detects buffer overruns in erroneous software before it occurs and thereby prevents attacks from corrupting the integrity of the system. Dynamic buffer overrun detectors have not been adopted widely because they either (1) cannot guard against all buffer overrun attacks (2) break existing code or (3) incur too high an overhead. This paper presents a practical detector called CRED (C Range Error Detector) that avoids each of these defeciencies.
Read the rest of this entry »

• 0 Comments