Slashdot Mirror

← Back to Domains

Domain: argeniss.com

Stories and comments across the archive that link to argeniss.com.

Stories · 2

  1. The Week of Oracle Database Bugs

    · posted by ryuzaki0 · from the your-turn dept. · 56 comments
    os2man writes "After the Month of Browser Bugs and the Month of Kernel Bugs, December will have a Week of Oracle Database Bugs. This project will release, every day for a week, a new 0-day bug specific to Oracle in order to show the current status of its [in]security. They are currently asking for new bugs, in order to extend the publication of new exploits a few more days."

  2. The Story of a Microsoft Patch

    It · Security · · posted by Zonk · from the live-and-learn dept. · 183 comments
    buckethead writes "eWeek is running a story about a security patch from Microsoft that failed to adequately address a denial-of-service flaw on CSRSS (Client/Server Runtime Server Subsystem), the user-mode part of the Win32 subsystem. It stems from a research paper from Argeniss that discusses how Microsoft only patched one path to the vulnerable function, but they forgot to do proper research to identify all the paths." From the article: "The problem was that Microsoft didn't patch the vulnerable function; they just added some validation code before the call to the vulnerable function, but what Microsoft missed was that the vulnerable function can be reached from different paths and the validation code was added on just one of them"