from:"dullien"

Re: An Alternate View of Recently Reported PHP Vulnerabilities

2003-04-05 Thread dullien

ccur in other languages which (in the end) chain down to C-like code. Cheers, dullien PS: Let us please just keep the entire Java discussion out of this :) -- Mit freundlichen Grüssen [EMAIL PROTECTED]mailto:[EMAIL PROTECTED]

Re: @(#)Mordred Labs advisory - Integer overflow in PHP memory allocator

2003-03-27 Thread Dullien

Hey Mr. Mordred, all, > In PHP emalloc() function implements the error safe wrapper around > malloc(). > Unfortunately this function suffers from an integer overflow and > considering the fact that emalloc() is used in many places around PHP > source code, it may lead to many serious security issu

Re: Preventing /exploitation with/ rebasing

2003-02-07 Thread dullien

Hey Riley, all, RH> Research AV/VX trends from the late 80's and early 90's. First off, thanks for this line. Reading some old VX magazines could do some good here. The fact that most shellcodes still use hardcoded addresses to retrieve GetProcAddress/GetModuleHandle should make everyone think --

Re[2]: Can't Preventing exploitation with rebasing

2003-02-05 Thread dullien

Hey all, bghn> DIGRESSION: bghn> Dave Litchfield says you can call esp. I don't know Dave's bghn> relationships with his registers but this doesn't work if I want bghn> to get my eip on top of my shellcode. Always starts executing a bghn> memory address for me. M

Re: Preventing exploitation with rebasing

2003-02-05 Thread dullien

Hey David, all, the method described in this paper has been previously described & implemented (in a much more thought-out manner) for Linux-based systems as PaX, to be found under pageexec.virtualave.net. DL> to infect this particular box; the "jmp esp" instruction that should've been DL> at 0x4

Re[2]: Preventing exploitation with rebasing

2003-02-04 Thread dullien

Hey David, (first off, Secfocus seems to have you on "fast moderator approval" track, I see your reply's before mine show up on BQ ;) DL> Keyword in my preceding statement : "almost" - as in "almost invulnerable". DL> The context of the discussion was a method to defeat exploits that use fixed DL

Re[2]: telnetd exploit code

2001-07-24 Thread dullien

Hey all, AS> If a hacker copyright's his code, and then releases it into the wild, what does that do for his rights under the copyright? AS> To turn it upside down, I have a machine that has had some hacker code placed on it. I didn't authorize it to be placed on there... Am I to be denied inve

Re: x86 vulnerability ?

2001-04-30 Thread Thomas Dullien

On Tue, 24 Apr 2001 16:27:33 -0700, Eric Hall wrote: >On Sun, May 07, 2000 at 11:44:14AM +0100, Cyber Hunter wrote: >> Does anyone know anything about the vulnerability found by the group LSD in >> the x86 systems ? That has helped them to win the Argus Event ? >> http://www.argus-systems.com/eve

Re: More vulnerabilities in FP

2000-04-20 Thread Thomas Dullien

ing in the file nonetheless strcat'ing user input onto the stack :-o Concerning the crash on 9x, might be that some important things for the cleanup are on the stack... I didn't test under 9x, but under NT SP5, so it might be that 9x doesn't like the overwriting of the stack. Thomas Dullien [EMAIL PROTECTED] Win32 Security Consultant ;-> Hire me !

Re: WordPad/riched20.dll buffer overflow

1999-11-23 Thread Thomas Dullien

ting around the place. Not one lies within a range we can point EIP to. >For anyone interested in NT buffer overruns some useful docs on the subject >can be found at http://www.infowar.co.uk/mnemonix Thomas Dullien [EMAIL PROTECTED] Win32 Security Consultant ;-> Hire me !