Security hole found in DEP (XP SP2)

[LocutusX]

Sorry if repost, searches did not reveal anything....

Major back door breach of Windows XP SP2 found

Russians claim to have entered Vole?s rear entrance

By Nick Farrell: Wednesday 02 February 2005, 07:49
A RUSSIAN security outfit claims to have worked a way around Microsoft's Windows XP Service Pack 2.

~snip~

But Positive Technology said that using the exploit it is possible to get arbitrary memory region write access (smaller or equal to 1016 bytes), Arbitrary code execution and a DEP bypass.

http://theinquirer.net/?article=21038


~~~

As an AMD Athlon64 owner, running XP SP2 with DEP on "protect all" enabled -- am I more susceptible to this hole (theoretically speaking) than a P4 user who has DEP on default settings?

 

[MrChad]

Details of the exploit

It sounds like this only affects 32-bit processors that rely on Microsoft's software-based DEP protection (although I could be mistaken, maybe I missed something in the article).

I wonder why the company waited 2 months to report this to Microsoft?

 

[Shamrock]

http://news.com.com/Microsoft+SP2+shimm.../2100-1002_3-5559369.html?tag=nefd.top

Microsoft says it isnt a vulnerability at all. it's a feature!

 

[spyordie007]

:yawn;

This is not a vulnerability or a security hole in XP/DEP. It just means that there is a possibility that if an application is written a certain way and contains a vulnerability that XP's software DEP wouldn?t be able to stop a buffer overflow from occurring were that vulnerability to be attacked.

Fact is XP SP2 is still far less likely to be vulnerable to buffer overflow attacks than it's predecessors because DEP can stop a lot of types of buffer overflows from occurring.

As an AMD Athlon64 owner, running XP SP2 with DEP on "protect all" enabled -- am I more susceptible to this hole (theoretically speaking) than a P4 user who has DEP on default settings?

No not at all, as MrChad pointed out your're less susceptible.

 

[imported_Lucifer]

Originally posted by: spyordie007

Fact is XP SP2 is still far less likely to be vulnerable to buffer overflow attacks than it's predecessors because DEP can stop a lot of types of buffer overflows from occurring.

As an AMD Athlon64 owner, running XP SP2 with DEP on "protect all" enabled -- am I more susceptible to this hole (theoretically speaking) than a P4 user who has DEP on default settings?

No not at all, as MrChad pointed out your're less susceptible.

How about us AMD XP users. Should we worry?