Tillbaka till svenska Fidonet
English   Information   Debug  
OS2BBS   0/787
OS2DOSBBS   0/580
OS2HW   0/42
OS2INET   0/37
OS2LAN   0/134
OS2PROG   0/36
OS2REXX   0/113
OS2USER-L   207
OS2   0/4785
OSDEBATE   0/18996
PASCAL   0/490
PERL   0/457
PHP   0/45
POINTS   0/405
POLITICS   0/29554
POL_INC   0/14731
PSION   103
R20_ADMIN   1117
R20_AMATORRADIO   0/2
R20_BEST_OF_FIDONET   13
R20_CHAT   0/893
R20_DEPP   0/3
R20_DEV   399
R20_ECHO2   1379
R20_ECHOPRES   0/35
R20_ESTAT   0/719
R20_FIDONETPROG...
...RAM.MYPOINT
  0/2
R20_FIDONETPROGRAM   0/22
R20_FIDONET   0/248
R20_FILEFIND   0/24
R20_FILEFOUND   0/22
R20_HIFI   0/3
R20_INFO2   2782
R20_INTERNET   0/12940
R20_INTRESSE   0/60
R20_INTR_KOM   0/99
R20_KANDIDAT.CHAT   42
R20_KANDIDAT   28
R20_KOM_DEV   112
R20_KONTROLL   0/13062
R20_KORSET   0/18
R20_LOKALTRAFIK   0/24
R20_MODERATOR   0/1852
R20_NC   76
R20_NET200   245
R20_NETWORK.OTH...
...ERNETS
  0/13
R20_OPERATIVSYS...
...TEM.LINUX
  0/44
R20_PROGRAMVAROR   0/1
R20_REC2NEC   534
R20_SFOSM   0/340
R20_SF   0/108
R20_SPRAK.ENGLISH   0/1
R20_SQUISH   107
R20_TEST   2
R20_WORST_OF_FIDONET   12
RAR   0/9
RA_MULTI   106
RA_UTIL   0/162
REGCON.EUR   0/2055
REGCON   0/13
SCIENCE   0/1206
SF   0/239
SHAREWARE_SUPPORT   0/5146
SHAREWRE   0/14
SIMPSONS   0/169
STATS_OLD1   0/2539.065
STATS_OLD2   0/2530
STATS_OLD3   0/2395.095
STATS_OLD4   0/1692.25
SURVIVOR   0/495
SYSOPS_CORNER   0/3
SYSOP   0/84
TAGLINES   0/112
TEAMOS2   0/4530
TECH   0/2617
TEST.444   0/105
TRAPDOOR   0/19
TREK   0/755
TUB   0/290
UFO   0/40
UNIX   0/1316
USA_EURLINK   0/102
USR_MODEMS   0/1
VATICAN   0/2740
VIETNAM_VETS   0/14
VIRUS   0/378
VIRUS_INFO   0/201
VISUAL_BASIC   0/473
WHITEHOUSE   0/5187
WIN2000   0/101
WIN32   0/30
WIN95   0/4277
WIN95_OLD1   0/70272
WINDOWS   0/1517
WWB_SYSOP   0/419
WWB_TECH   0/810
ZCC-PUBLIC   0/1
ZEC   4

 
4DOS   0/134
ABORTION   0/7
ALASKA_CHAT   0/506
ALLFIX_FILE   0/1313
ALLFIX_FILE_OLD1   0/7997
ALT_DOS   0/152
AMATEUR_RADIO   0/1039
AMIGASALE   0/14
AMIGA   0/331
AMIGA_INT   0/1
AMIGA_PROG   0/20
AMIGA_SYSOP   0/26
ANIME   0/15
ARGUS   0/924
ASCII_ART   0/340
ASIAN_LINK   0/651
ASTRONOMY   0/417
AUDIO   0/92
AUTOMOBILE_RACING   0/105
BABYLON5   0/17862
BAG   135
BATPOWER   0/361
BBBS.ENGLISH   0/382
BBSLAW   0/109
BBS_ADS   0/5290
BBS_INTERNET   0/507
BIBLE   0/3563
BINKD   0/1119
BINKLEY   0/215
BLUEWAVE   0/2173
CABLE_MODEMS   0/25
CBM   0/46
CDRECORD   0/66
CDROM   0/20
CLASSIC_COMPUTER   0/378
COMICS   0/15
CONSPRCY   0/899
COOKING   28437
COOKING_OLD1   0/24719
COOKING_OLD2   0/40862
COOKING_OLD3   0/37489
COOKING_OLD4   0/35496
COOKING_OLD5   9370
C_ECHO   0/189
C_PLUSPLUS   0/31
DIRTY_DOZEN   0/201
DOORGAMES   0/2014
DOS_INTERNET   0/196
duplikat   6000
ECHOLIST   0/18295
EC_SUPPORT   0/318
ELECTRONICS   0/359
ELEKTRONIK.GER   1534
ENET.LINGUISTIC   0/13
ENET.POLITICS   0/4
ENET.SOFT   0/11701
ENET.SYSOP   33805
ENET.TALKS   0/32
ENGLISH_TUTOR   0/2000
EVOLUTION   0/1335
FDECHO   0/217
FDN_ANNOUNCE   0/7068
FIDONEWS   23539
FIDONEWS_OLD1   0/49742
FIDONEWS_OLD2   0/35949
FIDONEWS_OLD3   0/30874
FIDONEWS_OLD4   0/37224
FIDO_SYSOP   12847
FIDO_UTIL   0/180
FILEFIND   0/209
FILEGATE   0/212
FILM   0/18
FNEWS_PUBLISH   4193
FN_SYSOP   41525
FN_SYSOP_OLD1   71952
FTP_FIDO   0/2
FTSC_PUBLIC   0/13583
FUNNY   0/4886
GENEALOGY.EUR   0/71
GET_INFO   105
GOLDED   0/408
HAM   0/16052
HOLYSMOKE   0/6791
HOT_SITES   0/1
HTMLEDIT   0/71
HUB203   466
HUB_100   264
HUB_400   39
HUMOR   0/29
IC   0/2851
INTERNET   0/424
INTERUSER   0/3
IP_CONNECT   719
JAMNNTPD   0/233
JAMTLAND   0/47
KATTY_KORNER   0/41
LAN   0/16
LINUX-USER   0/19
LINUXHELP   0/1155
LINUX   0/22010
LINUX_BBS   0/957
mail   18.68
mail_fore_ok   249
MENSA   0/341
MODERATOR   0/102
MONTE   0/992
MOSCOW_OKLAHOMA   0/1245
MUFFIN   0/783
MUSIC   0/321
N203_STAT   900
N203_SYSCHAT   313
NET203   321
NET204   69
NET_DEV   0/10
NORD.ADMIN   0/101
NORD.CHAT   0/2572
NORD.FIDONET   189
NORD.HARDWARE   0/28
NORD.KULTUR   0/114
NORD.PROG   0/32
NORD.SOFTWARE   0/88
NORD.TEKNIK   0/58
NORD   0/453
OCCULT_CHAT   0/93
Möte OSDEBATE, 18996 texter
 lista första sista föregående nästa
Text 5347, 431 rader
Skriven 2005-06-23 17:27:48 av Rich (1:379/45)
   Kommentar till text 5335 av Mike '/m' (1:379/45)
Ärende: Re: Microsoft meets the hackers
=======================================
From: "Rich" <@>

This is a multi-part message in MIME format.

------=_NextPart_000_02E3_01C57818.E04602C0
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

  As I said, you are pretty clear that you believe only what you want to =
believe.  Maybe you want to surprise us all and state publicly that you = have
so much trust in me that you would take my word on whether or not = you should
believe a third party.  Is that what you want to do?

Rich

  "Mike '/m'" <mike@barkto.com> wrote in message =
news:ebbmb19d1usj44vol0ir4cnhfvbjd8s430@4ax.com...

  I think is it a matter of you being deliberately evasive.

   /m

  On Wed, 22 Jun 2005 16:41:52 -0700, "Rich" <@> wrote:

  >   You are pretty clear that you believe only what you want to =
believe.
  >
  >Rich
  >
  >  "Mike '/m'" <mike@barkto.com> wrote in message =
news:egnjb19bg13ail2588m87un2r08b9j7ke5@4ax.com...
  >
  >  All I am asking is whether I can believe what that Microsoft =
security
  >  bulletin says. =20
  >
  >   /m
  >
  >
  >  On Tue, 21 Jun 2005 15:20:32 -0700, "Rich" <@> wrote:
  >
  >  >   You aren't saying much of anything except your typical =
propaganda.  What do you hope to gain by making claims regarding = something
about which you know something to someone who actually does = know something? 
Is this how you try to feel better about yourself?
  >  >
  >  >Rich
  >  >
  >  >  "Mike '/m'" <mike@barkto.com> wrote in message =
news:081hb1hkkat3tf0s5fk5be6d09sbju0bf6@4ax.com...
  >  >
  >  >  Once again, I am not saying anything about what the reporter =
claimed.
  >  >
  >  >  The Microsoft security bulletin states, "There is an unchecked =
buffer".
  >  >  http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx
  >  >
  >  >  Are you saying that the person who wrote that security bulletin
  >  >  published incorrect information about the security problem, and =
left it
  >  >  in place even after a revision of the bulletin?
  >  >
  >  >
  >  >   /m
  >  >
  >  >
  >  >
  >  >  On Mon, 20 Jun 2005 21:05:07 -0700, "Rich" <@> wrote:
  >  >
  >  >  >   And this is what the reporter claimed.  Maybe you would not =
report what was reported to you.  We likely will never know.  All we = know
today is that you are willing to make all sorts of claims about = something you
know nothing about trying to refute the statements of = someone with very good
knowledge of the issue.  It's not like you will = be any less clueless by
repeating yourself over and over.  Is this how = you feel better about
yourself?
  >  >  >
  >  >  >Rich
  >  >  >
  >  >  >  "Mike '/m'" <mike@barkto.com> wrote in message =
news:buveb1lm4bkds04ndd83g288f8ti81v4dc@4ax.com...
  >  >  >
  >  >  >  I am not talking about what the reporter wrote, I am talking =
about what
  >  >  >  the Microsoft security bulletin says in the Technical Details =
section.
  >  >  >
  >  >  >  =3D=3D=3D
  >  >  >  The first vulnerability is a buffer overrun vulnerability. =
There is an
  >  >  >  unchecked buffer in one of the components that handle NOTIFY =
directives
  >  >  >  - messages that advertise the availability of UPnP-capable =
devices on
  >  >  >  the network. By sending a specially malformed NOTIFY =
directive, it would
  >  >  >  be possible for an attacker to cause code to run in the =
context of the
  >  >  >  UPnP subsystem, which runs with System privileges on Windows =
XP. (On
  >  >  >  Windows 98 and Windows ME, all code executes as part of the =
operating
  >  >  >  system). This would enable the attacker to gain complete =
control over
  >  >  >  the system.
  >  >  >  =3D=3D=3D
  >  >  >
  >  >  >  "There is an unchecked buffer".   Man, that sounds rather =
specific to
  >  >  >  me.=20
  >  >  >
  >  >  >   /m
  >  >  >
  >  >  >
  >  >  >
  >  >  >
  >  >  >
  >  >  >  On Mon, 20 Jun 2005 19:44:07 -0700, "Rich" <@> wrote:
  >  >  >
  >  >  >  >   That and of course that bulletins rarely if ever mention =
this level of detail.  Unchecked buffers are one of the few exceptions = and
that I already explained.  The reporter claimed he could overflow a = buffer
though did not, and has not since that I can see, given any = evidence of this.
 My speculation is that better err on the side of = caution.
  >  >  >  >
  >  >  >  >Rich
  >  >  >  >
  >  >  >  >  "Rich" <@> wrote in message news:42b77b11$1@w3.nls.net...
  >  >  >  >     Not odd.  I didn't analyze it until after I saw the =
public bulletin release and what the reporter claims in his PR was the =
scenario that generated overflows.  I don't believe the reporter = understands
what he saw or if he did he kept that out of his PR and = anything else I could
find, public or private, on the topic.  Unlike the = reporter, I don't issue
press releases or call reporters with what I = find even if it could be
embarrassing to him.  But then I don't have a = financial interest in putting
others at risk just to try to make myself = look good.
  >  >  >  >
  >  >  >  >  Rich
  >  >  >  >
  >  >  >  >    "Mike '/m'" <mike@barkto.com> wrote in message =
news:15seb1pu019glla3ph9mnje9h2rogh4mnh@4ax.com...
  >  >  >  >    Oddly, I see no mention of a race condition in the =
official Microsoft
  >  >  >  >    security bulletin that was originally posted on December =
20, 2001 and=20
  >  >  >  >    updated on May 09, 2003
  >  >  >  >    =
http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx
  >  >  >  >
  >  >  >  >     /m
  >  >  >  >
  >  >  >  >
  >  >  >  >    On Mon, 20 Jun 2005 08:00:02 -0700, "Rich" <@> wrote:
  >  >  >  >
  >  >  >  >    >   A race condition.
  >  >  >  >    >
  >  >  >  >    >Rich
  >  >  >  >    >
  >  >  >  >    >  "Geo" <georger@nls.net> wrote in message =
news:42b699ed$2@w3.nls.net...
  >  >  >  >    >  Well what was it then?
  >  >  >  >    >
  >  >  >  >    >  Geo.
  >  >  >  >    >    "Rich" <@> wrote in message =
news:42b5feb2@w3.nls.net...
  >  >  >  >    >       It is not a buffer overflow.  It is not a buffer =
overrun.  Neither.
  >  >  >  >    >
  >  >  >  >    >    Rich

------=_NextPart_000_02E3_01C57818.E04602C0
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2900.2668" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>&nbsp; As I said, <FONT face=3D"Times =
New Roman"=20
size=3D3>you are pretty clear that you believe only what you want to=20
believe.&nbsp; Maybe you want to surprise us all and state publicly that =
you=20
have so much trust in me that you would take my word on whether or not = you=20
should believe a third party.&nbsp; Is that what you want to=20
do?</FONT></FONT></DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV>&nbsp;</DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
  <DIV>"Mike '/m'" &lt;<A =
href=3D"mailto:mike@barkto.com">mike@barkto.com</A>&gt;=20
  wrote in message <A=20
  =
href=3D"news:ebbmb19d1usj44vol0ir4cnhfvbjd8s430@4ax.com">news:ebbmb19d1us=
j44vol0ir4cnhfvbjd8s430@4ax.com</A>...</DIV><BR>I=20
  think is it a matter of you being deliberately=20
  evasive.<BR><BR>&nbsp;/m<BR><BR>On Wed, 22 Jun 2005 16:41:52 -0700, =
"Rich"=20
  &lt;@&gt; wrote:<BR><BR>&gt;&nbsp;&nbsp; You are pretty clear that you =
believe=20
  only what you want to =
believe.<BR>&gt;<BR>&gt;Rich<BR>&gt;<BR>&gt;&nbsp; "Mike=20
  '/m'" &lt;<A href=3D"mailto:mike@barkto.com">mike@barkto.com</A>&gt; =
wrote in=20
  message <A=20
  =
href=3D"news:egnjb19bg13ail2588m87un2r08b9j7ke5@4ax.com">news:egnjb19bg13=
ail2588m87un2r08b9j7ke5@4ax.com</A>...<BR>&gt;<BR>&gt;&nbsp;=20
  All I am asking is whether I can believe what that Microsoft=20
  security<BR>&gt;&nbsp; bulletin says.&nbsp; =
<BR>&gt;<BR>&gt;&nbsp;&nbsp;=20
  /m<BR>&gt;<BR>&gt;<BR>&gt;&nbsp; On Tue, 21 Jun 2005 15:20:32 -0700, =
"Rich"=20
  &lt;@&gt; wrote:<BR>&gt;<BR>&gt;&nbsp; &gt;&nbsp;&nbsp; You aren't =
saying much=20
  of anything except your typical propaganda.&nbsp; What do you hope to =
gain by=20
  making claims regarding something about which you know something to =
someone=20
  who actually does know something?&nbsp; Is this how you try to feel =
better=20
  about yourself?<BR>&gt;&nbsp; &gt;<BR>&gt;&nbsp; =
&gt;Rich<BR>&gt;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp; "Mike '/m'" &lt;<A=20
  href=3D"mailto:mike@barkto.com">mike@barkto.com</A>&gt; wrote in =
message <A=20
  =
href=3D"news:081hb1hkkat3tf0s5fk5be6d09sbju0bf6@4ax.com">news:081hb1hkkat=
3tf0s5fk5be6d09sbju0bf6@4ax.com</A>...<BR>&gt;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp; Once again, I am not saying anything =
about what=20
  the reporter claimed.<BR>&gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; The=20
  Microsoft security bulletin states, "There is an unchecked=20
  buffer".<BR>&gt;&nbsp; &gt;&nbsp; <A=20
  =
href=3D"http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx"=
>http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx</A><BR>=
&gt;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp; Are you saying that the person who wrote =
that=20
  security bulletin<BR>&gt;&nbsp; &gt;&nbsp; published incorrect =
information=20
  about the security problem, and left it<BR>&gt;&nbsp; &gt;&nbsp; in =
place even=20
  after a revision of the bulletin?<BR>&gt;&nbsp; &gt;<BR>&gt;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp;&nbsp; /m<BR>&gt;&nbsp; =
&gt;<BR>&gt;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; On Mon, 20 Jun 2005 =
21:05:07=20
  -0700, "Rich" &lt;@&gt; wrote:<BR>&gt;&nbsp; &gt;<BR>&gt;&nbsp; =
&gt;&nbsp;=20
  &gt;&nbsp;&nbsp; And this is what the reporter claimed.&nbsp; Maybe =
you would=20
  not report what was reported to you.&nbsp; We likely will never =
know.&nbsp;=20
  All we know today is that you are willing to make all sorts of claims =
about=20
  something you know nothing about trying to refute the statements of =
someone=20
  with very good knowledge of the issue.&nbsp; It's not like you will be =
any=20
  less clueless by repeating yourself over and over.&nbsp; Is this how =
you feel=20
  better about yourself?<BR>&gt;&nbsp; &gt;&nbsp; &gt;<BR>&gt;&nbsp; =
&gt;&nbsp;=20
  &gt;Rich<BR>&gt;&nbsp; &gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; =
&gt;&nbsp;=20
  "Mike '/m'" &lt;<A =
href=3D"mailto:mike@barkto.com">mike@barkto.com</A>&gt; wrote=20
  in message <A=20
  =
href=3D"news:buveb1lm4bkds04ndd83g288f8ti81v4dc@4ax.com">news:buveb1lm4bk=
ds04ndd83g288f8ti81v4dc@4ax.com</A>...<BR>&gt;&nbsp;=20
  &gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; I am not talking =
about=20
  what the reporter wrote, I am talking about what<BR>&gt;&nbsp; =
&gt;&nbsp;=20
  &gt;&nbsp; the Microsoft security bulletin says in the Technical =
Details=20
  section.<BR>&gt;&nbsp; &gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; =
&gt;&nbsp;=20
  =3D=3D=3D<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; The first vulnerability =
is a buffer=20
  overrun vulnerability. There is an<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; =

  unchecked buffer in one of the components that handle NOTIFY=20
  directives<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; - messages that =
advertise the=20
  availability of UPnP-capable devices on<BR>&gt;&nbsp; &gt;&nbsp; =
&gt;&nbsp;=20
  the network. By sending a specially malformed NOTIFY directive, it=20
  would<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; be possible for an attacker =
to cause=20
  code to run in the context of the<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; =
UPnP=20
  subsystem, which runs with System privileges on Windows XP. =
(On<BR>&gt;&nbsp;=20
  &gt;&nbsp; &gt;&nbsp; Windows 98 and Windows ME, all code executes as =
part of=20
  the operating<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; system). This would =
enable=20
  the attacker to gain complete control over<BR>&gt;&nbsp; &gt;&nbsp; =
&gt;&nbsp;=20
  the system.<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; =
=3D=3D=3D<BR>&gt;&nbsp; &gt;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; "There is an unchecked=20
  buffer".&nbsp;&nbsp; Man, that sounds rather specific to<BR>&gt;&nbsp; =

  &gt;&nbsp; &gt;&nbsp; me. <BR>&gt;&nbsp; &gt;&nbsp; &gt;<BR>&gt;&nbsp; =

  &gt;&nbsp; &gt;&nbsp;&nbsp; /m<BR>&gt;&nbsp; &gt;&nbsp; =
&gt;<BR>&gt;&nbsp;=20
  &gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; =

  &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; =
On Mon,=20
  20 Jun 2005 19:44:07 -0700, "Rich" &lt;@&gt; wrote:<BR>&gt;&nbsp; =
&gt;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp; That and of =
course=20
  that bulletins rarely if ever mention this level of detail.&nbsp; =
Unchecked=20
  buffers are one of the few exceptions and that I already =
explained.&nbsp; The=20
  reporter claimed he could overflow a buffer though did not, and has =
not since=20
  that I can see, given any evidence of this.&nbsp; My speculation is =
that=20
  better err on the side of caution.<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; =

  &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;Rich<BR>&gt;&nbsp; =
&gt;&nbsp;=20
  &gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;&nbsp; "Rich"=20
  &lt;@&gt; wrote in message <A=20
  =
href=3D"news:42b77b11$1@w3.nls.net">news:42b77b11$1@w3.nls.net</A>...<BR>=
&gt;&nbsp;=20
  &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp;&nbsp; Not odd.&nbsp; I =
didn't=20
  analyze it until after I saw the public bulletin release and what the =
reporter=20
  claims in his PR was the scenario that generated overflows.&nbsp; I =
don't=20
  believe the reporter understands what he saw or if he did he kept that =
out of=20
  his PR and anything else I could find, public or private, on the =
topic.&nbsp;=20
  Unlike the reporter, I don't issue press releases or call reporters =
with what=20
  I find even if it could be embarrassing to him.&nbsp; But then I don't =
have a=20
  financial interest in putting others at risk just to try to make =
myself look=20
  good.<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;<BR>&gt;&nbsp; =
&gt;&nbsp;=20
  &gt;&nbsp; &gt;&nbsp; Rich<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp; "Mike =
'/m'"=20
  &lt;<A href=3D"mailto:mike@barkto.com">mike@barkto.com</A>&gt; wrote =
in message=20
  <A=20
  =
href=3D"news:15seb1pu019glla3ph9mnje9h2rogh4mnh@4ax.com">news:15seb1pu019=
glla3ph9mnje9h2rogh4mnh@4ax.com</A>...<BR>&gt;&nbsp;=20
  &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp; Oddly, I see no mention =
of a race=20
  condition in the official Microsoft<BR>&gt;&nbsp; &gt;&nbsp; =
&gt;&nbsp;=20
  &gt;&nbsp;&nbsp;&nbsp; security bulletin that was originally posted on =

  December 20, 2001 and <BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp;=20
  &gt;&nbsp;&nbsp;&nbsp; updated on May 09, 2003<BR>&gt;&nbsp; =
&gt;&nbsp;=20
  &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp; <A=20
  =
href=3D"http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx"=
>http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx</A><BR>=
&gt;&nbsp;=20
  &gt;&nbsp; &gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp;=20
  &gt;&nbsp;&nbsp;&nbsp;&nbsp; /m<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; =

  &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp; On Mon, 20 Jun 2005 08:00:02 -0700, =
"Rich"=20
  &lt;@&gt; wrote:<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; =
&gt;<BR>&gt;&nbsp;=20
  &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp; &gt;&nbsp;&nbsp; A race=20
  condition.<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp;=20
  &gt;Rich<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp; =
&gt;&nbsp;=20
  "Geo" &lt;<A href=3D"mailto:georger@nls.net">georger@nls.net</A>&gt; =
wrote in=20
  message <A=20
  =
href=3D"news:42b699ed$2@w3.nls.net">news:42b699ed$2@w3.nls.net</A>...<BR>=
&gt;&nbsp;=20
  &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp; &gt;&nbsp; Well what was =
it=20
  then?<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp;=20
  &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp; =
&gt;&nbsp;=20
  Geo.<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp;=20
  &gt;&nbsp;&nbsp;&nbsp; "Rich" &lt;@&gt; wrote in message <A=20
  =
href=3D"news:42b5feb2@w3.nls.net">news:42b5feb2@w3.nls.net</A>...<BR>&gt;=
&nbsp;=20
  &gt;&nbsp; &gt;&nbsp; &gt;&nbsp;&nbsp;&nbsp;=20
  &gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; It is not a buffer =
overflow.&nbsp; It=20
  is not a buffer overrun.&nbsp; Neither.<BR>&gt;&nbsp; &gt;&nbsp; =
&gt;&nbsp;=20
  &gt;&nbsp;&nbsp;&nbsp; &gt;<BR>&gt;&nbsp; &gt;&nbsp; &gt;&nbsp;=20
  &gt;&nbsp;&nbsp;&nbsp; &gt;&nbsp;&nbsp;&nbsp;=20
Rich<BR></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_02E3_01C57818.E04602C0--

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)