[Full-Disclosure] WinXP SP2 comments (was: Internet explorer 6 execution of arbitrary code)

["Chris Carlson" <chris@xxxxxxxxxxxxxxx>]

No complaints from me.

While the new "security center" complains about how I don't have a firewall or 
antivirus installed (it doesn't detect either), the better security more than 
makes up for this minor annoyance - I no longer need to worry about where I go 
because the simple yet absolute 'no popups' and 'no software installations' 
security settings lock IE down so well.

A note about the security center- I *think* it can be disabled by editing the 
%systemroot%\inf\sysoc.inf file to show the entry for it in add/remove windows 
components.  I've tried to do this, but it either does not have immediate 
results, or does not work.  I havn't done any real research on it because of a 
lack of time (or perhaps patience), but would like to know how to get rid of 
this if anyone knows.

I think VirtualPC and SP2 have problems coexisting, since VirtualPC has never 
worked properly for me (host BSOD when starting a VM or VM BSOD while 
installing; comments?), but that aside I've seen no apparent problems- 
instability, memory management or otherwise.  

After attempting to uninstall SP2 (beta, not RC1 - all other comments are 
regarding RC1), many windows components claimed I was still running SP2, while 
others claimed SP1.  I think this may have caused some problems when attempting 
to install a second (very old) video adapter (BSOD, lockups, etc), but there's 
no way to be sure of it.  It appears to just be a quark in the installer.

/c

> -----Original Message-----
> From: Jelmer [mailto:jkuperus@xxxxxxxxx] 
> Sent: Sunday, June 06, 2004 22:17
> To: Chris Carlson
> Cc: full-disclosure@xxxxxxxxxxxxxxxx
> Subject: RE: [Full-Disclosure] Internet explorer 6 execution 
> of arbitrary code (An analysis of the 180 Solutions Trojan)
> 
> I haven't installed SP2 yet since I heard a lot of complaints 
> from people who claimed it caused instability, it had memory 
> management issues, some drivers didn't work, security 
> measures a bit too much in your face etc
> 
> But I reviewed the list of changes sometime back and I 
> concur, it looks very promising, I think in the near future 
> an IE exploit will be a rare occurrence as opposed to a bi 
> weekly event
> 
> -----Original Message-----
> From: Chris Carlson [mailto:chris@xxxxxxxxxxxxxxx]
> Sent: maandag 7 juni 2004 4:06
> To: Jelmer
> Cc: full-disclosure@xxxxxxxxxxxxxxxx; bugtraq@xxxxxxxxxxxxxxxxx
> Subject: RE: [Full-Disclosure] Internet explorer 6 execution 
> of arbitrary code (An analysis of the 180 Solutions Trojan)
> 
> When run remotely:
> 
> Line: 1
> Char: 1
> Error: Access is denied.
> Code: 0
> URL: http://62.131.86.111/security/idiots/repro/installer.htm
> 
> When run locally, software installation is blocked. 
> 
> Using IE 6.0.2900.2096 SP2, WinXP SP2
> 
> I've gotta say that SP2 has some VERY nice protection 
> builtin.  On the downside, I still havn't figured out how to 
> turn it off ;)
> 
> > -----Original Message-----
> > From: full-disclosure-admin@xxxxxxxxxxxxxxxx
> > [mailto:full-disclosure-admin@xxxxxxxxxxxxxxxx] On Behalf Of Jelmer
> > Sent: Sunday, June 06, 2004 21:22
> > To: bugtraq@xxxxxxxxxxxxxxxxx
> > Cc: full-disclosure@xxxxxxxxxxxxxxxx; peter@xxxxxxxxxxxxxxxx
> > Subject: [Full-Disclosure] Internet explorer 6 execution of 
> arbitrary 
> > code (An analysis of the 180 Solutions Trojan)
> > 
> > Just when I though it was save to once more use internet explorer I 
> > received an email bringing my attention to this webpage 
> > http://216.130.188.219/ei2/installer.htm   that according 
> to him used 
> > an exploit that affected fully patched internet explorer 6 
> browsers. 
> > Being rather skeptical I carelessly clicked on the link only to 
> > witness how it automatically installed addware on my pc!!!
> >  
> > Now there had been reports about 0day exploits making 
> rounds for quite 
> > some time like for instance this post
> >  
> > 
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0
> >  
> > However I hadn't seen any evidence to support this up until 
> now Thor 
> > Larholm as usual added to the confusion by deliberately spreading 
> > disinformation as seen in this post
> >  
> > http://seclists.org/lists/bugtraq/2004/May/0153.html
> >  
> > Attributing it to and I quote "just one of the remaining IE 
> > vulnerabilities that are not yet patched"
> > 
> > I've attempted to write up an analysis that will show that 
> there are 
> > at least 2 new and AFAIK unpublished vulnerabilities (feel free to 
> > proof me
> > wrong) out there in the wild, one being fairly sophisticated
> > 
> > You can view it at:
> > 
> > http://62.131.86.111/analysis.htm
> > 
> > Additionally you can view a harmless demonstration of the 
> > vulnerabilities at
> > 
> > http://62.131.86.111/security/idiots/repro/installer.htm
> > 
> > Finally I also attached the source files to this message
> > 
> > 
> 
> 
> 
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html