[Fwd: RE: First vulnerabilities in the SP2 - XP ?...]

[Gerald (Jerry) Carter]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

So streams are being used for security now ?   Hmmmm.....
Jeremy, better talk to Ted some more :-)



- -------- Original Message --------
Subject: RE: First vulnerabilities in the SP2 - XP ?...
Date: Thu, 19 Aug 2004 10:17:07 -0700
From: Thor Larholm <tlarholm at pivx.com>
To: Radoslav Dejanovic <radoslav.dejanovic at opsus.hr>,
<bugtraq at securityfocus.com>

| From: Radoslav Dejanović [mailto:radoslav.dejanovic at opsus.hr]
| > On Monday 16 August 2004 15:58, Jrme ATHIAS wrote:
| > http://www.heise.de/security/artikel/50051

| This might be SP2 bug only if the same bug can't be repeated
| on pre-SP2 machine. Didn't test, but I think this is an old
| trick. Anyone care to test it?

The entire concept of the Zone.Identifier altenate data stream is new to
XPSP2. Whenever you download any file from the web IE will add an ADS
called Zone.Identifier which specifies what IE security zone the file
originated from. Later, when the user tries to execute this file,
Explorer itself will check for this ADS. If it does not exist Explorer
will simply execute the file as it has always done, but if it does exist
and it specifies the Internet zone Explorer will then check for a valid
digital signature. If such a signature is not found Explorer will prompt
the user and ask whether to execute this unknown executable from an
unknown publisher.

Regardless of whether we think this has a high practical impact the
advisory from Jürgen does specify a way to circumvent a desired security
functionality which has been addded to XPSP2. Circumventing a desired
security functionality is always interested, especially seeing as this
is one of many first steps in a move toward digitally signing all
executables on the Windows platform.



Regards

Thor Larholm
Senior Security Researcher
PivX Solutions
23 Corporate Plaza #280
Newport Beach, CA 92660
http://www.pivx.com
thor at pivx.com
Stock symbol: (PIVX.OB)
Phone: +1 (949) 231-8496
PGP: 0x4207AEE9
B5AB D1A4 D4FD 5731 89D6  20CD 5BDB 3D99 4207 AEE9

PivX defines a new genre in Desktop Security: Proactive Threat Mitigation.
<http://www.pivx.com/qwikfix>


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBJiIoIR7qMdg1EfYRAkQ3AJ9Us5UwDoYBaVGgDYf/GOIQF6CQ7gCcDD+9
EESM0mYjuF/e+WPxrVqoI+U=
=IM42
-----END PGP SIGNATURE-----