Slashdot Mirror
F# - A New .Net language
Goalie_Ca writes "Neonerds.net has learned of an implementation of the ML programming language for the .NET Framework. F# is essentially an implementation of the core of the OCaml programming language . F#/OCaml/ML is a mixed functional-imperative programming language which is excellent for medium-advanced programmers and for teaching. In addition, you can access hundreds of .NET libraries using F#, and the F# code you write can be accessed from C# and other .NET languages. See the
F# Homepage."
did you folks hear about the first .NET buffer overflow? It, like everything else, is IIS-related. I got the email from MS's security advisory list a few days ago.....
.NET Framework
t in / S02-026.asp.
n / s02-026.asp
Title: Unchecked Buffer in ASP.NET Worker Process (Q322289)
Date: 06 June 2002
Software:
Impact: Denial of service, potentially run code of attacker's
choice
Max Risk: Moderate
Bulletin: MS02-026
Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulle
Issue:
======
ASP.NET is a collection of technologies that help developers to build web-based applications. Web-based applications, including those built using ASP.NET, rely on HTTP to provide connectivity. One characteristic of HTTP as a protocol is that it is stateless, meaning that each page request from a user to a site is reckoned an independent request. To compensate for this, ASP.NET provides for session state management through a variety of modes.
One of these modes is StateServer mode. This mode stores session state information in a separate, running process. That process can run on the same machine or a different machine from the ASP.NET application. There is an unchecked buffer in one of the routines that handles the processing of cookies in StateServer mode. A security vulnerability results because it is possible for an attacker to seek to exploit it by mounting a buffer overrun attack. A successful attack could cause the ASP.NET application to restart. As a result, all current users of the web-based application would see their current session restart and their current session information would be lost.
The StateServer mode is not the default mode for session
state management in ASP.NET. ASP.NET applications using StateServer mode that do not use cookies are not vulnerable.
Mitigating Factors:
====================
- StateServer mode is not the default mode for session state
management in ASP.NET. That ASP.NET application would have
to be specifically configured to use this mode.
- Even if an application was configured to use StateServer
mode, it would only be at risk if it also used cookies.
Risk Rating:
============
- Internet systems: Moderate
- Intranet systems: Moderate
- Client systems: None
Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
Security Bulletin at
http://www.microsoft.com/technet/security/bulleti
for information on obtaining this patch.
I am he as you are he as you are me and we are all together.
See how they run as root by exploit, see how they die.
I'm crying.
Sitting on a root shell, waiting for the kids to come.
ls | tee shit, stupid blody 'named',
Man, you been a naughty boy, you let your logs grow long.
I am the eggdrop, they are the eggdrop.
I am the Admin, goo goo g'joob.
Master Kiwi hacking freely,
Pretty little buffer overflows.
See how they write like scripts in disguise, see how they run.
I'm crying, I'm crying.
I'm crying, I'm crying...
[snip]
Will there be a language called S# (pronounced shash). You know, something that beauty contestants can program in...something to demonstrate during the talent portion. Although, I think I'd rather see some do Wynona Rider's ping pong ball trick personally...
If Mr. Edison had thought smarter he wouldn't sweat as much. --Nikola Tesla
"Maybe a little punishment is in order", spoke the demon Zaruzaman to the young girl
and little Sarah sighed, lifted the tattered remains of her blue skirt and began to dance in circles.
"Thumpapunga! Thumpapunga!" the demon roared and on each "Thump!" the petite girl
would clap her hands and call out the name of her tormentor, "Zaruzaman!".
Little Sarah knew that Zaruzaman would not relent until he was satisfied that her legs
were far, so far removed from the point of exertion that she would suffer painful
agonizing cramps that night. A night as every night spent, bound to a whipping tree
whose thorny branches would flagellate her naked back bloody when the entire tree
was swaying back and forth in the storm winds that came in every morning from the
the black sea at which shores Zaruzaman had struck camp.
The black sea was darkness beyond the concept of color. It was so black that it made
Zaruzaman's black and scaly skin appear pale as he paced up and down the short stretch
of shoreline he had selected for this day of Sarah's suffering. Soon he would make
her drink from the oily black and noxious substance that made ugly gurgling sounds as
it flogged the shore littered with sharp black spikes of basalt stone.
He smiled inwardly as he noticed Sarah stumble and cut an ugly gash across the length
of her right thigh. It would be hours until he would decide that Sarah was exhausted
enough and with her thighs shrieking in agony. Only then would her immense
capacity for enduring pain have been realized at it's fullest potential and only then
would further pain give way to the mercy of unconciousness. Zaruzaman knew better
than to allow her to escape so easily.
Sarah had gone to Hell and Hell accomodated her with Zaruzaman at her side. For all
Zaruzaman knew he had started existing the moment Sarah stepped into this endlessly
vast realm of agony and despair, yet his was not to dwell for long on the exact
mechanics and principles governing his existance. The only thing his mind could focus
clearly on was his task at hand, to bring the girl to the House of Pain and torment her
there for eternity. They had been walking for many months now along the shore of the
Black sea while Zaruzaman took delight in exploring the limits his imagination set his
cruelty, and also scouting the new frontiers of the ever expanding reaches of Sarah's
ability to endure pain. "Now you will drink, Sarah!" the demon exulted after Sarah had
stumbled often enough as her knees began to wobble and refused to even bear the
lightest of all weight her thin and supple body presented them with. There was no need
for Zaruzaman to reach out to grasp Sarahs long golden blonde hair in his black claws and
drag her to the shoreline. Sarah meekly obeyed and slowly and trembling walked towards
the darkness that was such a contrast to the raging hatred a bright red sky beamed
down on her.
The pain of the fluid boiling her body from the her toes to the tip of her hair she knew
how to endure. The despair and sorrow that oily, most revoltingly reeking fluid would
fill her with, however she could not bear, and yet she didn't dare to disobey for the
price he would exact from her for disobedience would be dear even by the standards
of the ordeal she had already gone through. Sarah knelt down and waves
of darkness washed over her knees as she cupped her hands to partake of the liquid
agony. She had to lift the hands more than once to her trembling lips, only to let
the oily substance wind it's way down her arms to return to the black mass of
hopelessness it came from. Soon she would have to drink, Sarah knew, and she could
already sense the demon becoming rapidly annoyed. Fear of the demon and fear
of drinking sized each other up and even though both weighed heavily on the little
girl, fear of drinking stepped far enough aside for Sarah to pass by both of them to
partake of the darkness that would fill her with loathing and regret. After each swallow she
would scream in agony as the oily substance ripped it's way through her throat to scald her chest
with incredible pain only to move on to rage in her stomach for hours . Sarah was in
fact thankful for the pain, for it kept her from succumbing to the utter despair the fluid
imparted on her soul. She had learned that it was better to concentrate on the pain
as she swallowed one mouthful of sorrow after the next.
___