Aloha, I've proposed to Microsoft that they stop publishing Mitigating Factors in their security bulletins, and now it looks necessary to propose the same in a more open forum. The following Mitigating Factors from MS03-005 are wrong. > Mitigating Factors: > ==================== > - An attacker would require the ability to log onto the system > interactively in order to run programs that use the Windows > Redirector. This vulnerability cannot be exploited remotely. > - Windows XP systems that are not shared between users would not > be at risk. In each case the following words need to be added, which turns these "Mitigating Factors" into "Aggravating Factors" which is a much more important and effective way to catalog exceptions to the generally-accepted rules of safety: "UNLESS arbitrary malicious code is allowed to execute on the local microprocessor, which can occur through the exploitation of numerous other vulnerabilities or as a result of unauthorized physical access to a computer." Microsoft (and others) need to discontinue the practice of publishing "Mitigating Factors" and opt instead for publishing "Aggravating Factors" that are conditions in which it is known that the threat posed by the vulnerability can be made worse. This would transform the Microsoft Knowledge Base into a compendium of infosec knowledge and put an end to the practice of systematically downplaying the severity of security vulnerabilities, a practice that misleads and misinforms. Sincerely, Jason Coombs jasoncat_private -----Original Message----- Sent: Wednesday, February 05, 2003 4:10 PM Subject: Microsoft Security Bulletin MS03-005: Unchecked Buffer in Windows Redirector Could Allow Privilege Elevation (810577) Title: Unchecked Buffer in Windows Redirector Could Allow Privilege Elevation (810577) Date: 05 February 2003 Software: Microsoft Windows XP Impact: Privilege elevation Max Risk: Important Bulletin: MS03-005 Microsoft encourages customers to review the Security Bulletins at: http://www.microsoft.com/technet/security/bulletin/ms03-005.asp http://www.microsoft.com/security/security_bulletins/ms03-005.asp
This archive was generated by hypermail 2b30 : Thu Feb 06 2003 - 08:01:59 PST