安全代码

I spent a couple of hours tonight reversing the vulnerable code responsible for the MS08-067 vulnerability. This bug is pretty interesting, because it is in the same area of code as the MS06-040 buffer overflow, but it was completely missed by all security researchers and Microsoft. It’s quite embarassing.

Here’s the code of the vulnerable function on Windows XP SP3 and Vista SP1:

#include <wchar.h>

// This is the decompiled function sub_5B86A51B in netapi32.dll on XP SP3

// and sub_6EA11D4D on Vista SP1



int ms08_067(wchar_t* path)

{

    wchar_t* p;

    wchar_t* q;

    wchar_t* previous_slash = NULL;

    wchar_t* current_slash  = NULL;

    wchar_t  ch;

 Read the rest of this entry »