RE: Windows Command Processor CMD.EXE Buffer Overflow

["Luis Alberto Cortes Zavala" <napasn () securitynation com>]

Mmmm i'm not sure in my OS Win XP SP2 Spanish, it crashes

EventType : BEX     P1 : cmd.exe     P2 : 5.1.2600.2180     P3 : 41107ebe

P4 : unknown     P5 : 0.0.0.0     P6 : 00000000     P7 : 00410041     
P8 : c0000005     P9 : 00000008  


Maybe it depends on lenguaje version.

Luis Alberto Cortes Zavala
IT / Security COnsultant

-----Mensaje original-----
De: listbounce () securityfocus com [mailto:listbounce () securityfocus com] En
nombre de Dan Yefimov
Enviado el: Domingo, 22 de Octubre de 2006 08:01 a.m.
Para: gregory_panakkal
CC: vuln-dev () securityfocus com
Asunto: Re: Windows Command Processor CMD.EXE Buffer Overflow

gregory_panakkal wrote:
> Hi,
>
> I had tested on couple of winxp sp2 fully patched systems, DEP came into
> the picture.
> On Win2k - the cmd.exe immediately terminates; on vista - no issues - it
> throws up a proper error.
This is not true. On completely patched Win2K cmd.exe doesn't terminate or
crash:

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\>%comspec% /k "dir
\\?\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
The filename or extension is too long.

C:\>