Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup

2006-04-23 Thread Thor (Hammer of God)
Nope. It's a protected file. Change it, or delete it, and it will come right back. Windows automatically restores protected system files to prevent corruption or alteration by malware. t On 4/16/06 11:54 AM, [EMAIL PROTECTED] [EMAIL PROTECTED] spoketh to all: Just take a binary editor to

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup

2006-04-23 Thread Thor (Hammer of God)
Then you've hosed your XP install. XP does not resolve cached addresses before the hosts file. Ping your 1918 domain controller. Add a bogus entry for the FQDN of the same machine. Ping it again. Hosts file overrides. I'm not sure what you mean by DNS failiures though. Please post something

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup

2006-04-23 Thread John Biederstedt
Actually, according to microsoft, the dns client in XP was *intended* to check to see if a dns lookup had failed earlier before going to the hosts file. We did ping the internal domain controller, added the bogus FQDN, and tried again. None of that worked, because prior to the VPN working, and

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup

2006-04-23 Thread Thor (Hammer of God)
You got a KB or some other official reference? I just did it again after a failed DNS looked. Lookup failed, added it in the hosts file, worked just fine. What exactly do you mean by dns lookup failed? The server is not available, or the host isn't found on the server? I just tested both ways

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup

2006-04-23 Thread Thor (Hammer of God)
I agree that there should have been better documentation of this, but I think the noted objections are a bit hyperbolic. While I don't disagree with what you said, I think there are some things you didn't consider. First, why is anything besides what is required for windows update being

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup

2006-04-23 Thread Geo.
MSN and MSDN. It is to keep hosts file entries from taking users to phishing sites where they may enter credentials that could be stolen. So you agree with me, that it's more for passport functionality than to allow trojaned users to get to windows update. It's not Microsoft's job to protect

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup

2006-04-23 Thread John Biederstedt
In brief: need a checkpoint firewall 4.1 or higher. set up a preshared key. install client on winXP machine -w- preshared key. boot XP box not in target network, but from a remote network connected to the Internet via TCP/IP. Once connectivity to the Internet is established do a dns lookup of

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup

2006-04-23 Thread Thor (Hammer of God)
I don't think your issue is with the XP client DNS resolver. If this consistently fails for you, it must be on the Checkpoint client side. I've tested this repeatedly in a myriad of different scenarios, and the resolution has worked exactly as it should in each case. With the exception of the

Re: Strengthen OpenSSH security?

2006-04-23 Thread Bob Goodman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Off topic, but anyway -- you could firewall those smart guys out, since they have to make more connections in less time then any sane legit user would. Something like http://www.bgnett.no/~peter/pf/en/bruteforce.html can be done with almost any

Yahoo! Mail XSS Vulnerability

2006-04-23 Thread Cheng Peng Su
Adivisory Name : Yahoo! Mail XSS Vulnerability Release Date : 2006.04.21 Application : Yahoo! web-based email service Test On : Microsoft IE 6.0 Discover : Cheng Peng Su(applesoup_at_gmail.com) Description: Yahoo! Mail is one of the Internet's most popular web based email solutions. Details:

MSIE (mshtml.dll) OBJECT tag vulnerability

2006-04-23 Thread Michal Zalewski
Perhaps not surprisingly, there appears to be a vulnerability in how Microsoft Internet Explorer handles (or fails to handle) certain combinations of nested OBJECT tags. This was tested with MSIE 6.0.2900.2180.xpsp.040806-1825 and mshtml.dll 6.00.2900.2873 xpsp_sp2_gdr.060322-1613. At first