Cisco VPN on Linux OpenSuse 10.3

I found this guide quite useful :

http://linux.wordpress.com/2008/01/17/cisco-vpn-client-opensuse-103/

Don’t worry about the fact that the link is for a x86-64 version. It works on 32bit systems too.

However, after the installation completed, I could not connect because of an error saying “The profile specified could not be read.” (if you get a “couldn’t connect” message it’s because the vpnclient connect command should be executed as root).

Here are the things to do:

January 26, 2008 | Filed Under Linux, Security | Comments Off 

IE7, Javascript, the WebBrowser control and bugs

Problem
Internet Explorer 7 (IE7) has been released. Applications around the world are breaking. … Well at least mine failed.
If you use the WebBrowser control in .NET applications or shdocwv ActiveX control you may hit this issue.

If you load the html by navigating to “about:blank” and then using DocumentText, AND you are including a script (using for example <script src=”somefile.js” language=”Javascript” type=”text/javascript”></script>) your script will effectively not be included. The main symptom is a “Error: Invalid Character” message or simply script failure.

This means that your other scripts and events in the page will fail. Most probably this is a security measure (I have a theory about it but before that .. the solution).

Solution : embed the Javascript in the HTML. You hoped for something better right ? :( Anyway embedding the script in the HTML solves the problem and if you are setting DocumentText from your code chances are it’s either generated by an XSLT (in which you can use either a msxsl javascript to include a file or a couple of xsl:include / xsl:apply-template without many side effects) or from your code (in which case.. well you are the programmer who did it, find a clean solution ;)).

Now, why have they introduced this change?
Probably they fear the scenario where a Javascript injects in some way in the DocumentText the include of a local file (along with some copy of itself) and then uses the data which now is in DocumentText in some .. evil way. I’ll try to forge some proof of concept demo.. if that is possible at all of course.

Edit
I’ve found this discussion [forums.microsoft.com] which propose a number of other interesting solutions.

Another interesting page with registry keys (process wide) for IE7 is here [msdn.microsoft.com].

October 26, 2006 | Filed Under .NET, C++, Programming, Security, Uncategorized, Win32 | 1 Comment 

WMF day-0 exploit

There is a security breach in the WMF (an old vectorial file format) support of Windows.
This is peculiar because :

You can read more about it in these places :

http://isc.sans.org/diary.php?storyid=975
http://www.f-secure.com/weblog/archives/archive-122005.html#00000753
http://www.microsoft.com/technet/security/advisory/912840.mspx
http://sunbeltblog.blogspot.com/2005/12/workaround-for-wmf-exploit.htm l

Update:
Here are some attacking scenarios not included in the posts I read about the problem :

December 29, 2005 | Filed Under Security | Comments Off 

Buffer overflow attacks bypassing DEP (NX/XD bits) - part 2 : Code injection

While the attack we’ve seen in the first part are indeed powerful, they are limited to simple calls to functions already linked by the program we’re going to attack. To appreciate full power we should exploit the technique used in the first part for injecting arbitrary code in the program.

The first experiment I tried was calling VirtualProtect to change the permissions on the stack. However it requires to know the exact address that was used in a previous call to VirtualAlloc to work properly, and I couldn’t find an immediate way to know that address. After that I investigated to check if I could trick the memory manager in changin permissions using VirtualAlloc. Doing this I found this wonderful blog article. Take your time and read it, it’s very interesting. Now, that’s time to try his trick on an executable.

Read more

June 5, 2005 | Filed Under Programming, Security, Win32, x86/64 (amd64) specific, x86/ia32 specific | 19 Comments 

Next Page →