Re: Third-party patch for CVE-2007-3896, UPDATE NOW

[<full-disclosure () mac hush com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Nice catch.

On Wed, 17 Oct 2007 08:16:21 -0400 "KJK::Hyperion"
<hackbunny () s0ftpj org> wrote:
> KJK::Hyperion ha scritto:
> > The present patch is dramatically under-tested and it has
> underwent no
> > quality assurance procedure whatsoever, so please deploy with
> the
> > greatest care.
>
> Indeed, I just found a gruesome memory leak in it. A silly bug,
> brown
> paperbag-grade shame. If you installed my patch, upgrade RIGHT
> THIS
> MOMENT NOW or slowly die:
>
> <http://spacebunny.xepher.net/hack/shellexecutefiasco/>
>
> For the press guys watching: THIS IS VERY IMPORTANT, more
> important than
> the original patch was. I don't expect "shitty patch actually
> shitty" to
> seriously make the big headlines, but, hey, a heads up: there is a
> good
> reason Microsoft takes a lot of time to put patches out, after
> all. I
> don't do this for the reputation, either: I already made a U-turn
> on my
> feelings about the vulnerability, I'm not too proud to admit my
> mistakes
> (god knows how big the egos can get in FD)
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcWACcACgkQqTTbVuUWvbIeJAQAjMVoG2QOfWjppdB4h8nIoXif0mLW
B1UQMSl33D268aEePFAVANvrYnhSQMqjWpuwxLPwDjsW0jgGuGahj3wh6K0Y4C7LGZzw
cBO2hPLyxTMYw6ZQS/iM0zYgmPuxz+N+dxsrqHFB2CV0JzKha3yPg02HEAVnmXlFV/RS
S/iUqf8=
=imp6
-----END PGP SIGNATURE-----


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/