Aloha,
I've proposed to Microsoft that they stop publishing Mitigating Factors in
their security bulletins, and now it looks necessary to propose the same in
a more open forum.
The following Mitigating Factors from MS03-005 are wrong.
> Mitigating Factors:
> ====================
> - An attacker would require the ability to log onto the system
> interactively in order to run programs that use the Windows
> Redirector. This vulnerability cannot be exploited remotely.
> - Windows XP systems that are not shared between users would not
> be at risk.
In each case the following words need to be added, which turns these
"Mitigating Factors" into "Aggravating Factors" which is a much more
important and effective way to catalog exceptions to the generally-accepted
rules of safety:
"UNLESS arbitrary malicious code is allowed to execute on the local
microprocessor, which can occur through the exploitation of numerous other
vulnerabilities or as a result of unauthorized physical access to a
computer."
Microsoft (and others) need to discontinue the practice of publishing
"Mitigating Factors" and opt instead for publishing "Aggravating Factors"
that are conditions in which it is known that the threat posed by the
vulnerability can be made worse.
This would transform the Microsoft Knowledge Base into a compendium of
infosec knowledge and put an end to the practice of systematically
downplaying the severity of security vulnerabilities, a practice that
misleads and misinforms.
Sincerely,
Jason Coombs
jasonc@science.org
-----Original Message-----
Sent: Wednesday, February 05, 2003 4:10 PM
Subject: Microsoft Security Bulletin MS03-005: Unchecked Buffer in
Windows Redirector Could Allow Privilege Elevation (810577)
Title: Unchecked Buffer in Windows Redirector Could Allow
Privilege Elevation (810577)
Date: 05 February 2003
Software: Microsoft Windows XP
Impact: Privilege elevation
Max Risk: Important
Bulletin: MS03-005
Microsoft encourages customers to review the Security Bulletins at:
http://www.microsoft.com/technet/security/bulletin/ms03-005.asp
http://www.microsoft.com/security/security_bulletins/ms03-005.asp
