Unpatched IIS Vulnerabilities / Microsoft July Security Bulletin

[king cope]

Hi Lists,

it seems Microsoft doesn't want to patch the vulnerabilities I posted
back in June,
at least not in the July update.

The posting included some important bugs in the Internet Information
Services, one of their
flagship products:
http://seclists.org/fulldisclosure/2012/Jun/189

The July Security Bulletin doesn't mention any bug.
http://technet.microsoft.com/en-us/security/bulletin/ms12-jul

I wonder if Microsoft will silently patch the vulnerabilities or just
bluntly ignore them.
I understand that Microsoft doesn't want to make a big deal about the
impact and exposure like in the past,
yet I believe that admins should be informed about the threats by
their very side.
You have to remember that I put much effort into finding these
vulnerabilities and you get them for free.
With resolving the bugs Microsoft proves that they care about security
even if these vulnerabilties
where disclosed uncoordinated yet free to patch.

/Kingcope

Re: [Full-disclosure] Unpatched IIS Vulnerabilities / Microsoft July Security Bulletin

[Thor (Hammer of God)]

Right - if you've compromised the server to the point you can alter
directory structures/names, the you've already bypassed the ACLs required
in order to exploit the vulnerability that allows you to bypass the
ACLs.  I don't get it.

t




On 7/16/12 10:47 AM, Григорий Братислава musntl...@gmail.com wrote:

On Mon, Jul 16, 2012 at 1:24 PM, king cope
isowarez.isowarez.isowa...@googlemail.com wrote:
 Hi Lists,

 it seems Microsoft doesn't want to patch the vulnerabilities I posted
 back in June,
 at least not in the July update.


Hello Full Disclosure!! !! !!

Is like to introduce you to Schrödinger's Cat and Wigner's Friend in
is Computer Security. 'The Wigner's Friend thought experiment posits a
friend of Wigner who performs the Schrödinger's cat experiment after
Wigner leaves the laboratory. Only when he returns does Wigner learn
the result of the experiment from his friend, that is, whether the cat
is alive or dead. The question is raised: was the state of the system
a superposition of dead cat/sad friend and live cat/happy friend,
only determined when Wigner learned the result of the experiment, or
was it determined at some previous point?'

http://en.wikipedia.org/wiki/Wigner's_friend
http://en.wikipedia.org/wiki/Schr%C3%B6dinger%27s_cat

IIS is neither vulnerable or not vulnerable. Is until you is exploit
it and verify!

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/