A reputable security defect reporting organization is claiming that a
Windows program is subject to a remote attack because:
* The vulnerable program (call it 'pqrminder') is registered as the
'handler' for files with a specific extension (call it '.pqr').
* If the user downloads a '.pqr' file (or is sent on in the mail and clicks
on it), then 'pqrminder' is invoked.
* If the file is malformed, then arbitrary code can be executed (buffer
overflow).
While recognizing that there is a bug here, that does not strike me as
being what is normally meant by a 'remote attack'.
--
Jonathan Leffler ([email protected])
STSM, Informix Database Engineering, IBM Information Management
4400 N First St, San Jose, CA 95134-1257
Tel: +1 408-956-2436 Tieline: 475-2436
"I don't suffer from insanity; I enjoy every minute of it!"
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
