Via ACROS Security -
Since our presentation of COM server-based binary planting exploits at the Hack in the Box conference in May this year, Microsoft has introduced a number of relevant changes to Windows and Internet Explorer.
[...]
Conclusion
Microsoft is clearly putting an effort into removing binary planting bugs from their code and introducing mitigations that help block various binary planting attack vectors. While we know there's still a lot of cleaning up to do in their binary planting closet, our research-oriented minds remain challenged to find new ways of exploiting these critical bugs and bypassing new and old countermeasures. In the end, it was our research that got the ball rolling and it would be a missed opportunity for everyone's security if we didn't leverage the current momentum and keep researching.
----------------------------------------------------------------------
Secunia's Windows Applications Insecure Library Loading List
http://secunia.com/advisories/windows_insecure_library_loading/
According to that list, Microsoft seems to be making good progress. Adobe and other vendors seem to be moving a bit slower on addressing these DLL loading vulnerabilities.
No comments:
Post a Comment