On Thu, 27 Jan 2005 09:00:39 +0100, "Nicolas RUFF (lists)" said: > But I would point out something much more important : there are many > more local exploits than remote (on Windows just like any other OS). > > Local exploits : about 1-2 a month > * POSIX - OS/2 subsystem exploitation > * Debugging subsystem exploitation (DebPloit) > * 16-bit subsystem exploitation (NTVDM) > * Shatter Attacks > * Etc. > > Remote exploits : about once a year > * RPC/DCOM (blaster) > * LSASS (sasser) > > Basically, if you are logged in as an unpriviledged user on a Terminal > Server, you can easily become SYSTEM. If this Terminal Server is also a > Domain Controller, game over. You forgot one important factor - the use of IE and Outlook for the fast direct-to-customer delivery of local exploits. Which *also* results in a Game Over....
Attachment:
pgp00138.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html