Re: EEYE: Microsoft ASN.1 Library LengthOverflow Heap Corruption

["Tim Kowalsky" <tekowalsky () deltecsolutions com>]

And how many vulnerabilities have been found by other researchers and not
had a patch or bulletin issued yet by Microsoft.

(Obviously that's a bit of a rhetorical question...)



> From: "Les Ault" <aultl () comcast net>
> Date: Tue, 10 Feb 2004 23:14:09 -0500
> To: "'Richard M. Smith'" <rms () computerbytesman com>,
> <full-disclosure () lists netsys com>
> Subject: RE: [Full-disclosure] EEYE: Microsoft ASN.1 Library Length Overflow
> Heap Corruption
>
> Apparently there are 7 upcoming advisories, and the oldest one is 93
> days old. 
>
> Link: http://www.eeye.com/html/Research/Upcoming/index.html
>
> -----Original Message-----
> From: full-disclosure-admin () lists netsys com
> [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Richard M.
> Smith
> Sent: Tuesday, February 10, 2004 9:41 PM
> To: full-disclosure () lists netsys com
> Subject: RE: [Full-disclosure] EEYE: Microsoft ASN.1 Library Length
> Overflow Heap Corruption
>
> Hi Marc, 
>
> > > > Date Reported: July 25, 2003
>
> Given that it took Microsoft almost 6 months to fix this problem, I'm
> wondering how many other Eeye security holes are in the queue that
> Microsoft
> is currently working on.  Enquiring minds would like to know! ;-)
>
> Richard
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html



CONFIDENTIALITY NOTICE:
This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain 
confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you 
are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original 
message.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html