Microsoft is in trouble....

Well with the recent leak of source code there are already vulnerabilites being posted on the internet:

[quote]Quote:

I downloaded the Microsoft source code. Easy enough. It's a lot
bigger than Linux, but there were a lot of people mirroring it and so
it didn't take long.

Anyway, I took a look, and decided that Microsoft is GAYER THAN AIDS.
For example, in win2k/private/inet/mshtml/src/site/download/imgbmp.cxx:

// Before we read the bits, seek to the correct location in the file
while (_bmfh.bfOffBits > (unsigned)cbRead)
{
BYTE abDummy[1024];
int cbSkip;

cbSkip = _bmfh.bfOffBits - cbRead;

if (cbSkip > 1024)
cbSkip = 1024;

if (!Read(abDummy, cbSkip))
goto Cleanup;

cbRead += cbSkip;
}

.. Rrrrriiiiggghhhttt. Way to go, using a signed integer for an
offset. Now all we have to do is create a BMP with bfOffBits > 2^31,

and we're in. cbSkip goes negative and the Read call clobbers the
stack with our data.

See attached for proof of concept. index.html has [img src=1.bmp]
where 1.bmp contains bfOffBits=0xEEEEEEEE plus 4k of 0x44332211.
Bring it up in IE5 (tested successfully on Win98) and get
EIP=0x44332211.

IE6 is not vulnerable, so I guess I'll get back to work. My Warhol
worm will have to wait a bit...

.gta
PROPS TO the Fort and HAVE IT BE YOU
[/quote]

Get some good firewall software - lol....

Much as I detest Microsoft, everything they produce and they way they crush competition, the person who leaked this ought to be strung up in a blistering desert by the short curlies and pelted with shards of NaOH.

i wish i knew wtf u were talking about marble...im not too smart

[QUOTE=infamous]i wish i knew wtf u were talking about marble...im not too smart[/QUOTE]

I don't know C++ or C really, but the idea is simple, If you are not careful with how you take in data that is too large, what does it do? In this case it sets an offset which is fixed. So all they are saying is throw it some damaging code that tricks the offset and that damaging code will be processed with that stack thingy. It's a security hole, basically. But that is all that I know.

[QUOTE=Utopian23]Much as I detest Microsoft, everything they produce and they way they crush competition, the person who leaked this ought to be strung up in a blistering desert by the short curlies and pelted with shards of NaOH.[/QUOTE]

I think these leaks and future ones are really going to show how detrimental society is being left running on windows servers. I think it's a great thing to have their source exposed so maybe some of the bigger issues that M$ refuses to acknowledge openly, they will be exposed. Such as how 'hacked' their OS is reported to be. If the source leaked, imo anything running M$ would be in trouble. This is something that they should have addressed with each new OS build, rather than continually build upon crappy code. That oil leak won't get any better by sticking putty and gum everytime you find a new hole. Fix that damn thing.

Hugs my Mac...

You know I can honestly say I really do like windows. Yes, I know... I'm sure it's mainly because it's all I ever used up until a few months ago. But things like that really do make me glad I got my Mac. Sure I miss certain windows only crowd pleasers. But I really don't miss the windows only exploits or viruses. And I'm sure I'll stil buy another PC down the road.

I may just wait until I get my super G5 now though...

I do like windows, it's just some of the things they do and the way they deal with them irks me a bit. But sometimes I ask myself why I even bother with windows anymore.

Hopefully this will steer people off the monoculture of Microsoft. I'm not really anti-Microsoft, but it's simply a fact that having the vast majority of the people on the same OS is bad practice. It makes it easier for hackers and crushes competition. Think about it, if everyone had the same immune system everyone would get sick around the same time and from the same virus, but because people are unique their systems react differently and certain viri don't harm certain people. Diversity is key.

Introducing diversity to a system where millions of people involved also reduces efficiency when it comes to upkeep and maintenance; all those OSes would require to use the same base algorithm to better address computer issues just to keep the bitching and the crying of the computer-illiterate to a minimum. And the fact that people are unique to their bodily systems makes it a difficult task to create an end-all cure for illness. I'm not defending Microsoft, nor am I considering to switch off it; they have a horde of lawyers to occupy that task. Microsoft is good at one thing for sure, and that's homogenizing the layperson's computer market.