MS08-078 and the SDL

Now its Firefox’s and Opera’s turn (Updated) « InfoSec Philippines

Sun, 21 Dec 2008 18:56:35 GMT

PingBack from http://infosecphils.wordpress.com/2008/12/19/now-its-firefoxs-and-operas-turn/

Microsoft explains how it missed critical IE bug

infoworld.com — Mon, 22 Dec 2008 22:55:21 GMT

Microsoft Corp.'s developers missed a critical bug in Internet Explorer because they weren't

Ejemplo Practico – Cuando los testers no están capacitados… o al menos no lo suficiente

El Ddaz — Wed, 24 Dec 2008 18:25:11 GMT

Este post esta adelantado a su tiempo  - porque tenia que salir antes otro post - , pero la situación

re: MS08-078 and the SDL

Kieran Tully — Fri, 26 Dec 2008 02:24:58 GMT

"The fix was to check the maximum iteration count on each loop iteration rather than once before the loop"

But does this actually fix the issue or just reduce the time window in which it can be exploited? Surely the correct fix is to make the check and action atomic with respect to the array?

re: MS08-078 and the SDL

Kieran Tully — Sat, 27 Dec 2008 00:04:57 GMT

Actually looking again the fix is fine; I thought the array update was happening in another thread.

Though surely Size() is 2 at the start, so MaxIdx is 1?

MSDN FLASH IRELAND - INTERNATIONAL RESOURCES - 15 JANUARY 2009

Microsoft Ireland Blog — Thu, 15 Jan 2009 16:21:12 GMT

a {color : #0033CC;} a:link {color: #0033CC;} a:visited.local {color: #0033CC;} a:visited {color : #800080;}

One Tool Does not Rule them All

The Security Development Lifecycle — Fri, 13 Feb 2009 00:44:08 GMT

Hello, Michael here... Over the last couple of years, I've released information about various Microsoft

re: MS08-078 and the SDL

Tanveer Badar — Thu, 12 Mar 2009 13:06:00 GMT

I agree with Kieran on this, moving the check closer will only shorten the time window but not prevent the exploit form happening.

Another correct fix, in addition to what Kieran suggested, would be to make a copy of array and act on it. I believe that's how CreateFile works, where it makes a copy of file name parameter before doing anything with it.