Re: [Full-disclosure] MS OWA 2003 Redirection Vulnerability - [MSRC 7368br]

[Peter Watkins]

On Sat, Nov 15, 2008 at 11:36:26AM -0500, Micheal Cottingham wrote:
> I found and reported this back in 2005/2006. Microsoft told me that it
> had been reported previously and that it would be fixed in the next
> release, which I'm guessing they meant 2007. I do not know if they
> have fixed it in Exchange 2007.

Similary, a few years ago (Nov/Dec 2005, I believe) I notified Microsoft 
about some CSRF flaws in OWA 2003. Sending a message, deleting a message, 
and logging out were all vulnerable. An attacker could trick a victim 
into sending an insult to her bosses (that would show up as an "internal"
message) and removing the message from her Sent Items folder. Clearing the 
deleted items folder, or removing a single message from the deleted items 
folder, did not appear to be vulnerable(!). Microsoft said the flaws were 
fixed in Exchange 2007 but I have no way of verifying that.

-Peter

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Firewire Attack on Windows Vista

[Peter Watkins]

On Wed, Mar 05, 2008 at 04:30:35PM -0500, Roger A. Grimes wrote:
> As somewhat indicated in the paper itself, these types of physical DMA 
> attacks are possible against any PC-based OS, not just Windows. If that's 
> true, why is the paper titled around Windows Vista?
> 
> I guess it makes headlines faster.  But isn't as important, if not more 
> important, to say all PC-based systems have the same underlying problem?  
> That it's a broader problem needing a broader solution, instead of picking on 
> one OS vendor to get headlines?

Roger, you should note that Adam's "Hit by a Bus" paper includes information
about how Linux users can load their OS' Firewire driver in a way that should
disallow physical memory DMA access, and close this attack vector. I have not
yet seen anyone explain how to do the same in Windows. If there is no such
option in Windows (as the Panholzer paper claims), then Microsoft deserves 
the negative attention.

> [Disclaimer: I'm a full-time Microsoft employee.] 

As for "broader solutions", Microsoft is in an excellent position to help
improve the situation -- maybe you could shed some light on their efforts?

-Peter

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/