SBDA âsame bug, different appâ - Security Assessment

More documents

Recommendations

Info

The CLSID SBDA • June/July 2005 javaprxy.dll Instantiation Perfect candidate for SBDA A new vector – unexpected com object instantiation New targets – IE through multiple com objects • As We Expected Exploits through other objects were discovered Another patch to fix multiple objects, or the root cause? • But Still? #:>reg query HKEY_CLASSES_ROOT\CLSID > exploit.htm Some basic search replace Load into IE….. and wait Copyright Security-Assessment.com 2005
SBDA To The Test • Quick File Based Vulnerability Demonstration Do we have time? Copyright Security-Assessment.com 2005
Page 1 and 2: SBDA “same bug, different app”
Page 3 and 4: SBDA - What It’s Not • Not The
Page 5 and 6: SBDA - The Conception • I Wanted
Page 7 and 8: How Can This Be Applied To Research
Page 9 and 10: The SBDA Advantage • Gives Resear
Page 11 and 12: The AV / Archive SBDA (in reverse)
Page 13 and 14: Packet vs File • Both Are Data Bo
Page 15 and 16: Some Common Test Methods • Fuzzin
Page 17 and 18: SDBA Theory In Practice • Some Ex
Page 19 and 20: The Long Value SBDA • Length Valu
Page 21 and 22: The Long Import SBDA • Jan, 2005
Page 23: The URL Handler SBDA • Mar 09, 20
Page 27 and 28: 2 nd Generation Vulnerabilities •
Page 29 and 30: Wrap Up • Same Bug, Different App

SBDA âsame bug, different appâ - Security Assessment

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?

SBDA âsame bug, different appâ - Security Assessment