Vista Exploit Surfaces on Russian Hacker Site

Datamation writes "Exploit code for Windows Vista (though at this point only proof-of-concept code) has been published to a Russian hacker site, Eweek reports. Certain strings sent through the 'MessageBox' API apparently cause memory corruption. Though this is obviously cause for concern, at the moment it would seem access to the system would already be required to make use of the exploit. Determina has an analysis of the bug. Just last week, Trend Micro reported that Vista zero-days are being sold at underground hacker sites for $50,000."

Meant to say this last week.. but..

[The Living Fractal]

Obviously Microsoft is missing these holes in Vista in house.

Maybe the biggest customer for these zero-day exploits should be.. Microsoft?

$50,000 isn't that much compared to the other option IMHO.

Just a thought.

TLF

Double free vulnerability

[Utopia]

How does one go about exploiting a double free vulnerability?
The article just mentions that Windows has a double free vulnerability but does not post an exploit (and neither does the russian site which originally reported this issue).

.

Re:Meant to say this last week.. but..

[lachesis-jp]

That's possibly what the guys selling the exploits are hoping for: that Microsoft buys it from them and as you say $50,000 isn't much for Microsoft. Actually, maybe Microsoft should actually start a program to reward people that submit vulnerabilities in relation to security risk caused by it. This might actually help make Vista secure quickly if they pay well. And if they have any confidence in the fact that Vista is a relatively secure OS, they shouldn't have to worry that it is going to cost them too much as each bug that disapear is a bug that won't be discovered anymore.

Re:Meant to say this last week.. but..

[The Living Fractal]

Agreed. It would be generally very poor form for a company to do such a thing.

And obviously the people who sell these exploits want to get more than one sale out of each one. Selling them to Microsoft means, hopefully, the end of the exploit and no more sales. So if MS really did buy these exploits, they'd have to do it without letting the hackers find out it was them buying the exploits. Because the hackers would probably never want to sell them to MS.

I'm sure this fits into some science fiction plot somewhere. And the truth as it is said is often stranger than fiction.

TLF

Microsoft still hasn't learned about safe strings!

[raddan]

Which is ironic, because they actually have a page [microsoft.com] on handling strings safely. So are they lazy, stupid, or both? Lemme guess-- they couldn't use their own API because someone wrote the MessageBox API in assembly...?

More details on this

[wumpus188]

... from another russian forum [bugtraq.ru] (roughly translated from russian...)

Function GetHardErrorText
Comment:
* This function figures out the message box title, text and flags.
* We want to do this up front so we can log this error when the hard error is
* raised. Previously we used to log it after the user had dismissed the message
* box -- but that was not when the error occurred (DCR Bug 107590)

This function finds and extracts strings like "{EXCEPTION}" from MessageBox's text and if found, writes them in the system log.

} else if ((asLocal.Length > 4) && !_strnicmp(asLocal.Buffer, "\\??\\", 4)) {
strcpy( asLocal.Buffer, asLocal.Buffer+4 );
Local.Length -= 4;

Say, nice use of strcpy...

Re:Why now?

[hackstraw]

A smart black hat would lay low until SP1 is released, and wait for the real corporate deployment to begin.

A smart black hat has like a job and a life.

The only thing I can say that these script kiddies and whatnot are good for is that they are easily detectable and they alert security people of vulnerabilities so that it makes it difficult for people that are really interested in doing real damage or obtaining data that they shouldn't have.

Its really ironic how valuable these kids are. Without them, real compromises would be more common and much more painful.