You people amaze me.... you are too busy proving that each other suck to just get the word out on exploits. You should note that I never claimed who discovered it, I honestly don't care. I know personally I would prefer if political agendas or conspiracy theories stay off the list. Point is, systems are insecure, get the word out. Pat on the back for whoever did discover it...
So revised version of original message: I haven't seen much if any coverage of a rather nasty exploit in Windows XP that was discovered by what I believe was a human on earth. If you would like to keep your XP boxes from being venerable to this exploit which happens to delete whatever a properly formed link requests, delete %windir%\PCHEALTH\HELPCTR\System\DFS\uplddrvinfo.htm Thank you to Thor for posting more accurate information in reply to my message.... Shane Hird discovered it. You can see his post here: http://cert.uni-stuttgart.de/archive/bugtraq/2002/08/msg00224.html And you can try a proof-of-concept here: http://jscript.dk/2002/8/sec/xphelpdelete.html And you can see all of the 20 publicly known unpatched vulnerabilities in Internet Explorer here: http://www.pivx.com/larholm/unpatched/ -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Tuesday, September 10, 2002 2:36 PM Subject: Re: [Full-Disclosure] XP security hole uplddrvinfo.htm -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Steve Gibson=FUD charlaten www.grcsucks.com >Sorry if this has already been posted but I was made aware of a > rather >ugly security hole in Windows XP. > FUD FUD FUD >This vulnerability allows the files contained in any specified >directory >on your system to be deleted if you click on a specially formed > URL. >This URL could appear anywhere: sent in malicious eMail, in a c >hat room, >in a newsgroup posting, on a malicious web page, or even execut >ed when Geogie Guninski discovered this long time ago. Major vulnerability also exist if user type format command wrong. Gibson no skills not discover this. >your computer merely visits a malicious web page. It is likely >to be >widely exploited soon. Widely exploited soon? Gibson planning something? bullshit bullshit bullshit >This vulnerability is so dangerous that it would be irresponsib >le for me >to say more. Microsoft has known of this problem for months and FUD FUD FUD bullshit bullshit bullshit. Gibson is marketing. General terms high level bullshit mean more consultant dollars. > has, >inexplicably, done nothing before now. Although XP's Service Pa >ck 1 is >not small (approx 30 MB for express installation or 140 MB for >the >network install), and even though a much quicker and easier sol >ution to >this problem exists, the only thing I can safely recommend (wit >hout >revealing too much) is to urge all XP users to somehow obtain a >nd >install Service Pack 1 immediately. (If you have a slow Interne >t >connection, perhaps a friend can download the executable Servic >e Pack >file and burn it onto a CD for you?) More fud fud fud bullshit bullshit bullshit. Problem fixed with hotfix not sp1. Gibson very dumb. >This problem does not affect any systems other than Windows XP. > If you >have any friends or co-workers running Windows XP, please urge >them to >update their systems' too. Once the details of this vulnerabili >ty have >leaked through other channels I will provide additional informa >tion. Gibson planning leak? Tell friends that Gibson great security guy and pay to consult. bullshit bullshit bullshit FUD FUD FUD >there is an alternative. There's a file you can rename or delet >e to fix >the security hole. Here are the steps: > >Perform a search for a file on your C drive called "uplddrvinfo >.htm." >Once you've found the file, delete it or rename it. Doing so wi >ll not >hinder your ability to use Windows XP. bullshit bullshit bullshit. Does not fix problem. Gibson is dumb. -----BEGIN PGP SIGNATURE----- Version: Hush 2.1 Note: This signature can be verified at https://www.hushtools.com wlgEARECABgFAj1+RfMRHGdvYmJsZXNAaHVzaC5jb20ACgkQpmwDHEAx56siiwCgkCxM SwzADNeDmHjVlFWgxDpK9yoAn3sN5Hqhxdyn9xOAFsdmtRYDN3Vd =Ok0V -----END PGP SIGNATURE----- Get your free encrypted email at https://www.hushmail.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
