Vista Vulnerability report published for Year 1

re: Vista Vulnerability report published for Year 1

tony — Thu, 17 Apr 2008 00:28:38 GMT

yes I believe MS is doing a great job of securing their new products but I don't like the comparisons to other products rhel has a higher number of total sec vulns but how many are remotely exploitable how many are elevation issues.. ? I'm not worried about local exploits cause if your on the box u own it anyway. But like I said MS is still doing a great job, keep up the good work!

Vista Vulnerability report published for Year 1 | Windows Guides | Mintywhite.com

Thu, 17 Apr 2008 08:00:30 GMT

PingBack from http://mintywhite.com/tech/news/vista-vulnerability-report-published-for-year-1/

re: Vista Vulnerability report published for Year 1

Mark Sowul — Thu, 17 Apr 2008 15:07:31 GMT

You shouldn't ignore local exploits - a seemingly innocuous elevation-of-privilege vulnerability can turn a remote access vulnerability into complete control of the machine.

For example: would you rather have two hypothetical IIS vulnerabilities that let you execute code in the context of the IIS account (these would probably be marked "important" or "critical," or would you rather have one such vulnerability ("important"/"critical") and one local elevation-of-privilege vulnerability (probably would be marked as "low" or "important")?

In the first case, the damage is non-trivial, but limited because the IIS account would have few privileges on its own. In the second, you could piggyback the EoP on top of the remote vulnerability, and now you own the whole machine.

Vunerabilidades do Vista 1 ano depois do lançamento

Inside Microsoft — Thu, 17 Apr 2008 17:46:34 GMT

Diferença grande se comparado com o XP. Metric Windows Vista (1 year) Windows XP (1 year) Vulnerabilities

Internet Explorer Security Patch

Malcolm Bullock - Optimising Infrastructure for business benefit — Thu, 18 Dec 2008 20:16:06 GMT

This isn't something that I would normally bother blogging on - and from the lack of recent posts you