Given that the scenario behind this presumes that the user downloads an executable and runs it from the command line one could be just as vulnerable running Mozilla or any other browser that allows you to download files. Add a chmod step and other operating systems are just as "vulnerable." The only remotely interesting point here is that zone information doesn't follow the files reliably into the file system. Personally I'm not surprised by this, and it appears that neither is Microsoft. He's assuming behavior that isn't indicated or documented. Where do we draw the line on this social engineering stuff? If I send an e-mail to someone telling them to flush their iPod down the crapper does that mean the iPod is vulnerable to a toilet attack? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blog.ziffdavis.com/seltzer larryseltzer@xxxxxxxxxxxxx -----Original Message----- From: Oliver Schneider [mailto:Borbarad@xxxxxxxxxx] Sent: Tuesday, August 17, 2004 12:30 PM To: "Jérôme" ATHIAS Cc: bugtraq@xxxxxxxxxxxxxxxxx Subject: Re: First vulnerabilities in the SP2 - XP ?... Hi, > http://www.heise.de/security/artikel/50051 I also read this yesterday (the German version) and I think it's not a vulnerability. It's IMO a misconception in the way how SP2 treats alien executables. And on the other hand it does not actually lower the value of SP2 concerning security - because the rest of SP2 already boosted security (this time despite compatibility issues - thanks to MS for finally skipping compatibility in favor of security). But I agree with the author that MS should fix this anyway! Can someone please check if ShellExecute()/ShellExecuteEx() behave different from the CreateProcess-functions *)? Could that be the reason? Where is the information stored, that a file was downloaded - ADS? - EAs? ... some arcane new feature? Oliver *) CreateProcess, CreateProcessAsUser, CreateProcessWithLogonW, CreateProcessWithTokenW -- --------------------------------------------------- May the source be with you, stranger ... ;)
