IE8, Safari, iPhone All Fall At Pwn2Own Contest

SpuriousLogic writes "The annual Pwn2Own contest at CanSecWest is underway, and on the first day Web browsers fell to attack. Internet Explorer 8 and Firefox 3.6.2 on 64-bit Windows 7 and Safari on OS X all were forced to run exploit code. To add insult to injury, an iPhone was cracked and the SMS database lifted from it." Updated 22:40 GMT by timothy: CWmike adds this interesting bit: "The only researcher to three-peat at the Pwn2Own hacking contest said on Thursday that security is such a 'broken record' that he won't hand over 20 vulnerabilities he's found in Apple's, Adobe's and Microsoft's software. Instead Charlie Miller will show the vendors how to find the bugs themselves."

Comments

Re:So 64-bit ASLR on Windows is flawed as well...

[aristotle-dude]

VS has never done this for me. Which version of Visual Studio are you talking about? Really VS.NET? Because that's 7 years old AFAIK.

VS 2008 is a 32bit application and it is not even large address space aware so when it is running inside of WOW (windows on windows) in 64bit Server 2008 R2, you will get memory fragmentation fairly quickly because of memory allocation bugs within the Wow subsystem of the 64bit version of any MSFT OS. As Sir_Lewk points out, any 32bit application can cause this problem. The less memory you have, they faster you will notice it.

See this page for information on the problem:

http://stevenharman.net/blog/archive/2008/04/29/hacking-visual-studio-to-use-more-than-2gigabytes-of-memory.aspx

Here is a fix for the problem:

http://confluence.jetbrains.net/display/ReSharper/OutOfMemoryException+Fix

Other OSes like OS X and linux do not seem to have these sort of problems. I am able to run 64bit apps in Snow Leopard while running in 32bit kernel mode for driver compatibility. Not only does windows not run 32bit apps properly in 64bit mode but it cannot run 64bit apps in 32bit mode and the 64bit version is a completely separate build of the OS.