* Jason Coombs: > Kurt Seifried wrote: >> Actually it really is that simple. Disabling Null sessions is >> entirely possible, quite easy, and doesn't break a lot (at least in >> my previous > > Then why doesn't Microsoft provide these instructions in the workarounds > section of the vulnerability announcement?
Attacks using proper accounts are still possible, AFAIK. These days, it's hard to explain such fine points in advisories because all the useful details have been eliminated and vendors fear to give away too much information. In the present case, it didn't help to delay the exploit, of course. > I'm supposed to do Microsoft's job for them? No way. Well, it's your computers that are potentially compromised, not theirs. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
