The vulnerability of a Windows DLL with the EXE misuse of a good influence

Windows DLL, removal of a recently discovered vulnerability that I think is more important. Until now, you're looking for with higher priority can be found in the guide, Windows DLL eulrodeureul confirmed that the current working directory. Then the attacker to exploit vulnerabilities in the system you are using a DLL that has an unknown will. Secunia This vulnerability can be visited by the affected DLL, a Windows program that you want to see a list of users. , 123 applications, a total of 47 additional suppliers will be affected at the time of writing.

The problem is that changes to the executable file is a list of priority research. Acros, according to a blog post on security exe in Windows, the highest or second highest priority is loaded into the blog.

This is an example to the current working directory in the Windows directory or the directory path to be in an environment before looking for ways to start a new process.

The attacker, such as executable files in the working directory to place the name, for example, a malicious application Explorer.exe Guy executed by the user of the system was launched by the former can exploit.

What does this mean? This solution is available to protect against this vulnerability to hijack the number of efforts to protect important not to take ineurobuteo EXE DLL ways.

In fact, the current directory, the second request (NULL, "calc.exe" CreateProcess to call something like … when you try to run the Windows calculator), malignant Calc. exe Hide the working directory is kept in place. And the remote is also the current working directory on remote network shares on the local network or the Internet If you are getting the point. And, contrary to run the distance and safety of users will not be issued a warning to use the ShellExecute function to open *. That is what we all know, security warnings ShellExecute such functions, the introduction of today's operating back-end, without man with multiple batch and server operations and can cause serious problems.

Acros and test open to the public that they have created. Line planting Binaryplanting.com exposure test binaries are available. The test for users who want to attack the exhibition is for planting totest binary.

At least you are not using WebDAV users the best way to solve the problem, it is off. Windows Keyboard Shortcuts in Windows 7 users – Type R in services.msc, the Windows service requires an open and press the Enter key. And they basically according to the manual should be able to find the WebClient. Double-entry and uncheck all the services do not click on your operating system.

The problem is still in its units, WebDAV does not exist after the liberation. The example of Apple's browser has been updated since the attacks (which can be used in Apple's Safari Web browser, a) the receipt of

In Apple's Safari for Windows after the process of implementation errors, an attacker to load and run on a local disk and remote Windows share, and EXE] malicious [there are stocks we can create the Internet.

A remote attacker on the network share to do with what a malicious Explorer.exe, factories and users with Safari, open the HTML file from a network location – which will require a minimum of social engineering. Then, the user (), for example, the menu: Window -> Downloads -> Right-click the file -> folder view the content of the folder containing the downloaded file to open the explorer. exe is the beginning of a legal rather than malicious.

Or an HTML file (if 10 or) "file: / / location", a malicious attempt to Safari in the release of product in the Windows Explorer Explorer.exe to start connecting. (Via)

Oracle OpenWorld 2010: confusion or clarity?

Within two weeks, developers, customers, analysts and the media hordes will be down at the Oracle OpenWorld. Until this morning, I think it is very promising for the merger, Oracle will provide a range of applications focused on. Plus there are in other positions. Instead, my mind turns to the wide range of issues.

Larry Dignan, HP CEO Mark Hurd, recently expelled from office by the history of Wall Street Journal on society to participate in the meeting

Do not know exactly what Hurd, however, the ITC, ASA is the OAS and the hardware that I put my head in the company, HP former CEO, and later, okay? Noted. In other words, Oracle CEO Larry Ellison, estate planning immediately.

Larry Dignan, Oracle for a number of reasons why it is added. I think Mr. Frank said Scavo. But then nothing can be considered for Oracle will be surprised.

Earlier this year, Oracle Co-President Charles Phillips has held the top slot of the exchange was about the fence in the arch unfortunate display in Times Square are blocked by the ads were common to find a way. Safra Cataz do all sorts of speculation Phillips, co-chairman led the integration of a few days ago, but coach deal. Ellison still do not need arose Phillips, Philips adds CIO.com more fuel to the notion of leaving notes to reduce responsibilities was. Global Business Unit, Oracle said that while checking the changes:

… The fact that Philips has not disappeared "speculative" in output.

In the same article, the authors have made an exit, Hurd, he could fill the place of Phillips speculates.

Safra Catz is rumored to take place in the high HP can continue to turn soybeans is another fantasy. I see nothing. HP over the accounting required? Again, nothing is impossible. Yesterday, Barrons Hurd has promised to send it through the door Katz (although see, now is the role of CEO) said:

Massage Ellison has not expressed a desire retired to a place to have a successor. Co-President Safra Catz Catz director Peter Goldmacher of Cowen leaveâsomething that Ellison will not be a doubt because Goldmacher, Hurd joins Oracle to think it would be unlikely. "Safra, and Mark is a proven technology leader. Safra Mark Hurd, adding that the reason for changing the existing order, and did an excellent job at Oracle Goldmacher is postulated.

Confused? You should be! But this is not the end.

While HP is a terrible article, with speculation of origin, Larry Dignan, Oracle will be on Hurd, Jason Hiner said the approval rating of HUD employees. Ellison, meanwhile, 78% of staff enjoy approval rates. HP employees at the time of the complaint to HUD, in my opinion was the real reason behind his departure. Ellison to take the risk of history repeating itself, could they be ready?

And we saw the police officer. Ann Livermore, HP vice president of corporate affairs, including Allison and Katz set the tone for the opening session, Hurd, then I talk to join or what? Whatever happens before the period of service personnel has gained fresh. And Oracle Fusion version of a relatively limited run the risk of disappointing customers think. Now so easily on the desktop to the announcement of some dramatic changes can now turn our attention. Oracle offers to add to speculation about the possibility of a boiler pot, you're on Wall Street.

. Wait, do not constitute Jeff Nolan says:

Heard in discussions with Oracle, I went to Chuck Phillips told a high-power amplifier | In fact, Canat determine these things.