Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-13 Thread Georgi Guninski
On Thu, Jun 10, 2010 at 08:36:09AM -0700, Susan Bradley wrote: > saying I would have spent a little more time getting mad at them and > sent a lot more emails back to them before posting this. > so do it - sent a lot of mails to them before posting this. nobody stops you from sending mails to th

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Benji
You're just jealous I had the intuition to protect myself. Sent from my iPhone On 11 Jun 2010, at 17:03, T Biehn wrote: It's a good thing I ran that anti-hacker script!!! On Fri, Jun 11, 2010 at 11:28 AM, Benji wrote: because when she gets 0wn3d she can be all like 'ruh roh, well, 0day can

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread T Biehn
So far so good. You've been able to go from t biehn -> Travis Biehn -> Bomber Article (parent's names, city, state, country) -> whitepages.com (Address and Phone number) -> (not clear on your jump here, did you google their name or for the address?) Real estate listings. Now to pull the SS and CC #

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread musnt live
On Fri, Jun 11, 2010 at 1:53 PM, T Biehn wrote: > So far so good. > You've been able to go from t biehn -> Travis Biehn -> Bomber Article > (parent's names, city, state, country) -> whitepages.com (Address and Phone > number) -> (not clear on your jump here, did you google their name or for > the

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread T Biehn
Maybe you can call twice and get both of them really upset? -Travis On Fri, Jun 11, 2010 at 1:21 PM, musnt live wrote: > On Fri, Jun 11, 2010 at 1:06 PM, T Biehn wrote: > > Totally, I'd work on getting a dog too. > > > > On Jun 11, 2010 12:20 PM, "musnt live" wrote: > > > > On Fri, Jun 11, 20

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread John Jacobs
> Hello list. I'd like to warn you about Susan Bradley. I've seen her > pictures and for its you must be desperate to want to own her. > > http://www.smbnation.com/Portals/0/speakers/speaker_susan-bradley.jpg s/PMS/menopause/gi

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread musnt live
On Fri, Jun 11, 2010 at 1:43 PM, T Biehn wrote: > Maybe you can call twice and get both of them really upset? > Maybe I will. Would she let me sit on her bed? http://images.realogyfg.com/j/2/5/15907460/62A47ADD-C353-4F73-94FB-742937D88A0B-6.jpg Oh n00z all this information for on this little wan

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread musnt live
On Fri, Jun 11, 2010 at 1:06 PM, T Biehn wrote: > Totally, I'd work on getting a dog too. > > On Jun 11, 2010 12:20 PM, "musnt live" wrote: > > On Fri, Jun 11, 2010 at 12:03 PM, T Biehn wrote: >> It's a good thing I ran that a... > > It's a good thing there is to be a local bomb squad near me. >

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread T Biehn
Totally, I'd work on getting a dog too. On Jun 11, 2010 12:20 PM, "musnt live" wrote: On Fri, Jun 11, 2010 at 12:03 PM, T Biehn wrote: > It's a good thing I ran that a... It's a good thing there is to be a local bomb squad near me. http://www.cbc.ca/world/story/2005/06/13/canadian-bomb050613.h

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread musnt live
On Fri, Jun 11, 2010 at 12:03 PM, T Biehn wrote: > It's a good thing I ran that anti-hacker script!!! It's a good thing there is to be a local bomb squad near me. http://www.cbc.ca/world/story/2005/06/13/canadian-bomb050613.html ___ Full-Disclosure -

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread musnt live
On Fri, Jun 11, 2010 at 11:28 AM, Benji wrote: > because when she gets 0wn3d she can be all like 'ruh roh, well, 0day > can happen to anyone' Hello list. I'd like to warn you about Susan Bradley. I've seen her pictures and for its you must be desperate to want to own her. http://www.smbnation.co

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread T Biehn
It's a good thing I ran that anti-hacker script!!! On Fri, Jun 11, 2010 at 11:28 AM, Benji wrote: > because when she gets 0wn3d she can be all like 'ruh roh, well, 0day > can happen to anyone' > > On Fri, Jun 11, 2010 at 4:01 PM, Benjamin Franz > wrote: > > On 06/11/2010 02:40 AM, Christian Sci

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Benji
because when she gets 0wn3d she can be all like 'ruh roh, well, 0day can happen to anyone' On Fri, Jun 11, 2010 at 4:01 PM, Benjamin Franz wrote: > On 06/11/2010 02:40 AM, Christian Sciberras wrote: >> In my humble opinion, he could have waited a couple more days just in >> case Microsoft decided

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Benjamin Franz
On 06/11/2010 02:40 AM, Christian Sciberras wrote: > In my humble opinion, he could have waited a couple more days just in > case Microsoft decided to do the unprecedented. > In which case, I progressive change of policies at Microsoft are > better than a couple of users getting hacked from pron

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread musnt live
On Thu, Jun 10, 2010 at 12:16 PM, Tavis Ormandy wrote: > > I will not answer anymore uninformed questions on this topic. > > Riddle me this Tavis. For why not responsible disclosure you put millions of Microsoft customers at risk. Hello list, I'd like to warn you about reckless disclosure. Imag

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread John Jacobs
bugt...@securityfocus.com Subject: Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly In my humble opinion, he could have waited a couple more days just in case Microsoft decided to do the unprecedented. In which case, I progressive change of policie

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Christian Sciberras
In my humble opinion, he could have waited a couple more days just in case Microsoft decided to do the unprecedented. In which case, I progressive change of policies at Microsoft are better than a couple of users getting hacked from pron sites... Cheers. On Thu, Jun 10, 2010 at 8:20 PM, Benjamin

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Bud Spencer
Hello list, The included POC seems to work fine with IE7 or IE8 installed, however I am not able to run any javascript code on a clean XP SP2 with IE6. Does that mean that you require a newer browser to use the defer trick?, is machines with IE6 for a change unaffected? I see that Tavis says "

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Benjamin Franz
On 06/10/2010 09:26 AM, Susan Bradley wrote: > You commented that Microsoft needs to address a communication > problem. It's irrelevant to the full disclosure issue in my mind. > > I'd honestly like to know if there is a break down in communication at > the MSRC that needs to be addressed. It a

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Jhfjjf Hfdsjj
Hey just wanted to say that my default installation of Windows 7 doesnt seem vulnerable~no hcp protocol handler. Just thought some people would like to take note :) - Original Message From: Tavis Ormandy To: full-disclosure@lists.grok.org.uk Cc: bugt...@securityfocus.com Sent: Wed, J

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Tavis Ormandy
On Thu, Jun 10, 2010 at 07:21:48PM +0200, Tavis Ormandy wrote: > On Thu, Jun 10, 2010 at 07:02:03PM +0200, Thomas Kristensen wrote: > > Tavis, > > > > Nice find, but during our analysis we discovered that your hotfix > > unfortunately is inadequate. > > > > For more information see: > > http://se

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Tavis Ormandy
On Thu, Jun 10, 2010 at 07:02:03PM +0200, Thomas Kristensen wrote: > Tavis, > > Nice find, but during our analysis we discovered that your hotfix > unfortunately is inadequate. > > For more information see: > http://secunia.com/blog/103/ > Patches are, of course, welcome. Thanks, Tavis. -- -

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread musnt live
On Thu, Jun 10, 2010 at 12:59 PM, Christian Sciberras wrote: > Susan, if you want my advise, don't even bother with Mr Live. > > Cheers. > > > Hello Full Disclosure, I will now speak to you about chauvinism. For starters here Mrs. Susan chose to call me Mr. not knowing the identity of this mine ge

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread musnt live
On Thu, Jun 10, 2010 at 12:18 PM, Susan Bradley wrote: > Nope Mr. Live, other than dealing with .NET updates and a 982331 that keeps > wanting to have UAC turned off on some Win7/Vistas to get installed, this is > just my normal calm, try to also consider the consumers and patchers > viewpoint per

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Tavis Ormandy
Susan, this is what is called "full disclosure", and my response was relevant. I will not answer anymore uninformed questions on this topic. Thanks, Tavis. On Thu, Jun 10, 2010 at 09:02:37AM -0700, Susan Bradley wrote: > I'm not asking about disclosure. I'm asking what happened to the level >

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread Tavis Ormandy
Susan, I wish I had the time to hold your hand through getting up to speed on the disclosure debate. Instead, I would suggest starting with the links in my advisory which were intended to give you enough background to understand the issues involved (skip to the Notes section, if you like). As I ca

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-11 Thread musnt live
On Thu, Jun 10, 2010 at 11:36 AM, Susan Bradley wrote: > I'm not an enterprise customer, but I am a mouthy female. > > Hello Full Disclosure, I'd like to warn you about PMS! ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-d

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-10 Thread Thomas Kristensen
Tavis, Nice find, but during our analysis we discovered that your hotfix unfortunately is inadequate. For more information see: http://secunia.com/blog/103/ Removing the HCP URI handler seems like the only proper workaround as of now. /Thomas On Thu, 2010-06-10 at 01:46 +0200, Tavis Ormandy w

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-10 Thread Christian Sciberras
Susan, if you want my advise, don't even bother with Mr Live. Cheers. On Thu, Jun 10, 2010 at 6:26 PM, Susan Bradley wrote: > You commented that Microsoft needs to address a communication problem. > It's irrelevant to the full disclosure issue in my mind. > > I'd honestly like to know if th

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-10 Thread Susan Bradley
You commented that Microsoft needs to address a communication problem. It's irrelevant to the full disclosure issue in my mind. I'd honestly like to know if there is a break down in communication at the MSRC that needs to be addressed. It appears there is one? Tavis Ormandy wrote: > Susan, t

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-10 Thread Susan Bradley
Nope Mr. Live, other than dealing with .NET updates and a 982331 that keeps wanting to have UAC turned off on some Win7/Vistas to get installed, this is just my normal calm, try to also consider the consumers and patchers viewpoint person today. musnt live wrote: > > On Thu, Jun 10, 2010 at 11:

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-10 Thread Susan Bradley
I'm not asking about disclosure. I'm asking what happened to the level of communication between you and MSRC that after 4 days you posted this? Tavis Ormandy wrote: > Susan, I wish I had the time to hold your hand through getting up to > speed on the disclosure debate. Instead, I would suggest s

Re: [Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-10 Thread Susan Bradley
I'm not an enterprise customer, but I am a mouthy female. So here's my question back to you, for my education, how exactly did MSRC contact you back? Since June 5th have you tried emailing back or any of your contacts from past interactions and asked what was up? I'm disappointed in this lack

[Full-disclosure] Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly

2010-06-09 Thread Tavis Ormandy
Microsoft Windows Help Centre Handles Malformed Escape Sequences Incorrectly Help and Support Centre is the default application provided to access online documentation for Microsoft Windows. Microsoft supports accessing h