From: "Randy" 

This is a multi-part message in MIME format.

------=_NextPart_000_001B_01C57773.472441B0
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Pot, meet kettle.
  "Rich"  wrote in message news:42b9f5bf{at}w3.nls.net...
     You are pretty clear that you believe only what you want to =
believe.

  Rich

    "Mike '/m'"  wrote in message =
news:egnjb19bg13ail2588m87un2r08b9j7ke5{at}4ax.com...

    All I am asking is whether I can believe what that Microsoft =
security
    bulletin says. =20

     /m


    On Tue, 21 Jun 2005 15:20:32 -0700, "Rich"  wrote:

    >   You aren't saying much of anything except your typical =
propaganda.  What do you hope to gain by making claims regarding =
something about which you know something to someone who actually does =
know something?  Is this how you try to feel better about yourself?
    >
    >Rich
    >
    >  "Mike '/m'"  wrote in message =
news:081hb1hkkat3tf0s5fk5be6d09sbju0bf6{at}4ax.com...
    >
    >  Once again, I am not saying anything about what the reporter =
claimed.
    >
    >  The Microsoft security bulletin states, "There is an unchecked =
buffer".
    >  http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx
    >
    >  Are you saying that the person who wrote that security bulletin
    >  published incorrect information about the security problem, and =
left it
    >  in place even after a revision of the bulletin?
    >
    >
    >   /m
    >
    >
    >
    >  On Mon, 20 Jun 2005 21:05:07 -0700, "Rich"  wrote:
    >
    >  >   And this is what the reporter claimed.  Maybe you would not =
report what was reported to you.  We likely will never know.  All we = know
today is that you are willing to make all sorts of claims about = something
you know nothing about trying to refute the statements of = someone with
very good knowledge of the issue.  It's not like you will = be any less
clueless by repeating yourself over and over.  Is this how = you feel
better about yourself?
    >  >
    >  >Rich
    >  >
    >  >  "Mike '/m'"  wrote in message =
news:buveb1lm4bkds04ndd83g288f8ti81v4dc{at}4ax.com...
    >  >
    >  >  I am not talking about what the reporter wrote, I am talking =
about what
    >  >  the Microsoft security bulletin says in the Technical Details =
section.
    >  >
    >  >  =3D=3D=3D
    >  >  The first vulnerability is a buffer overrun vulnerability. =
There is an
    >  >  unchecked buffer in one of the components that handle NOTIFY =
directives
    >  >  - messages that advertise the availability of UPnP-capable =
devices on
    >  >  the network. By sending a specially malformed NOTIFY =
directive, it would
    >  >  be possible for an attacker to cause code to run in the =
context of the
    >  >  UPnP subsystem, which runs with System privileges on Windows =
XP. (On
    >  >  Windows 98 and Windows ME, all code executes as part of the =
operating
    >  >  system). This would enable the attacker to gain complete =
control over
    >  >  the system.
    >  >  =3D=3D=3D
    >  >
    >  >  "There is an unchecked buffer".   Man, that sounds rather =
specific to
    >  >  me.=20
    >  >
    >  >   /m
    >  >
    >  >
    >  >
    >  >
    >  >
    >  >  On Mon, 20 Jun 2005 19:44:07 -0700, "Rich"  wrote:
    >  >
    >  >  >   That and of course that bulletins rarely if ever mention =
this level of detail.  Unchecked buffers are one of the few exceptions =
and that I already explained.  The reporter claimed he could overflow a =
buffer though did not, and has not since that I can see, given any =
evidence of this.  My speculation is that better err on the side of =
caution.
    >  >  >
    >  >  >Rich
    >  >  >
    >  >  >  "Rich"  wrote in message
news:42b77b11$1{at}w3.nls.net...
    >  >  >     Not odd.  I didn't analyze it until after I saw the =
public bulletin release and what the reporter claims in his PR was the =
scenario that generated overflows.  I don't believe the reporter =
understands what he saw or if he did he kept that out of his PR and =
anything else I could find, public or private, on the topic.  Unlike the =
reporter, I don't issue press releases or call reporters with what I = find
even if it could be embarrassing to him.  But then I don't have a =
financial interest in putting others at risk just to try to make myself =
look good.
    >  >  >
    >  >  >  Rich
    >  >  >
    >  >  >    "Mike '/m'"  wrote
in message =
news:15seb1pu019glla3ph9mnje9h2rogh4mnh{at}4ax.com...
    >  >  >    Oddly, I see no mention of a race condition in the =
official Microsoft
    >  >  >    security bulletin that was originally posted on December =
20, 2001 and=20
    >  >  >    updated on May 09, 2003
    >  >  >    =
http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx
    >  >  >
    >  >  >     /m
    >  >  >
    >  >  >
    >  >  >    On Mon, 20 Jun 2005 08:00:02 -0700,
"Rich"  wrote:
    >  >  >
    >  >  >    >   A race condition.
    >  >  >    >
    >  >  >    >Rich
    >  >  >    >
    >  >  >    >  "Geo"  wrote
in message =
news:42b699ed$2{at}w3.nls.net...
    >  >  >    >  Well what was it then?
    >  >  >    >
    >  >  >    >  Geo.
    >  >  >    >    "Rich"  wrote in message =
news:42b5feb2{at}w3.nls.net...
    >  >  >    >       It is not a buffer overflow.  It is not a buffer =
overrun.  Neither.
    >  >  >    >
    >  >  >    >    Rich

------=_NextPart_000_001B_01C57773.472441B0
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable








Pot, meet kettle.

  "Rich" <{at}> wrote in message news:42b9f5bf{at}w3.nls.net...
     You are
pretty clear =
that you=20
  believe only what you want to believe.
  Rich
   
  
    "Mike '/m'" <mike{at}barkto.com>">mailto:mike{at}barkto.com">mike{at}barkto.com>
wrote in =
message news:egnjb19bg13=
ail2588m87un2r08b9j7ke5{at}4ax.com...All=20
    I am asking is whether I can believe what that Microsoft=20
    securitybulletin says. 
 /mOn Tue, =
21 Jun=20
    2005 15:20:32 -0700, "Rich" <{at}>
wrote:>   =
You=20
    aren't saying much of anything except your typical propaganda.  =
What do=20
    you hope to gain by making claims regarding something about which =
you know=20
    something to someone who actually does know something?  Is this =
how you=20
    try to feel better about =
yourself?>>Rich>> =20
    "Mike '/m'" <mike{at}barkto.com>=20">mailto:mike{at}barkto.com">mike{at}barkto.com>=20
    wrote in message news:081hb1hkkat=
3tf0s5fk5be6d09sbju0bf6{at}4ax.com...>> =20
    Once again, I am not saying anything about what the reporter=20
    claimed.>>  The Microsoft
security bulletin =
states,=20
    "There is an unchecked buffer".>  http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx"=
>http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx;=
>> =20
    Are you saying that the person who wrote that security=20
    bulletin>  published incorrect information about the =
security=20
    problem, and left it>  in place even after a
revision of =
the=20
   
bulletin?>>>  =20
   
/m>>>> 
On Mon, 20 Jun 2005 =
21:05:07 -0700,=20
    "Rich" <{at}>
wrote:>> 
>   And =
this is=20
    what the reporter claimed.  Maybe you would not report what was =

    reported to you.  We likely will never know.  All we know =
today is=20
    that you are willing to make all sorts of claims about something you =
know=20
    nothing about trying to refute the statements of someone with very =
good=20
    knowledge of the issue.  It's not like you will be any less =
clueless by=20
    repeating yourself over and over.  Is this how you feel better =
about=20
    yourself?> 
>> 
>Rich> =20
    >>  >  "Mike
'/m'" <mike{at}barkto.com>">mailto:mike{at}barkto.com">mike{at}barkto.com>
wrote in =
message news:buveb1lm4bk=
ds04ndd83g288f8ti81v4dc{at}4ax.com...> =20
    >>  >  I am not
talking about what the =
reporter=20
    wrote, I am talking about what> 
>  the =
Microsoft=20
    security bulletin says in the Technical Details =
section.> =20
    >>  > 
=3D=3D=3D>  >  The =
first=20
    vulnerability is a buffer overrun vulnerability. There is =
an> =20
    >  unchecked buffer in one of the components that handle =
NOTIFY=20
    directives>  >  - messages
that advertise the=20
    availability of UPnP-capable devices on> 
>  the =

    network. By sending a specially malformed NOTIFY directive, it=20
    would>  >  be possible for an
attacker to cause =
code to=20
    run in the context of the> 
>  UPnP subsystem, =
which=20
    runs with System privileges on Windows XP. (On>  =
> =20
    Windows 98 and Windows ME, all code executes as part of the=20
    operating>  >  system). This
would enable the =
attacker=20
    to gain complete control over> 
>  the=20
    system.>  > 
=3D=3D=3D>  =
>> =20
    >  "There is an unchecked
buffer".   Man, that =
sounds=20
    rather specific to>  >  me.
> =20
    >>  >  
/m>  =
>> =20
    >> 
>>  >>  =
>> =20
    >  On Mon, 20 Jun 2005 19:44:07 -0700, "Rich"
<{at}>=20
    wrote:>  >> 
>  >   =
That and=20
    of course that bulletins rarely if ever mention this level of =
detail. =20
    Unchecked buffers are one of the few exceptions and that I already=20
    explained.  The reporter claimed he could overflow a buffer =
though did=20
    not, and has not since that I can see, given any evidence of =
this.  My=20
    speculation is that better err on the side of
caution.>  =

    >  >> 
>  >Rich>  =
> =20
    >>  > 
>  "Rich" <{at}> wrote in =
message=20
    news:42b77b11$1{at}w3.nls.net...=
> =20
    >  >     Not
odd.  I didn't =
analyze it=20
    until after I saw the public bulletin release and what the reporter =
claims=20
    in his PR was the scenario that generated overflows.  I don't =
believe=20
    the reporter understands what he saw or if he did he kept that out =
of his PR=20
    and anything else I could find, public or private, on the =
topic. =20
    Unlike the reporter, I don't issue press releases or call reporters =
with=20
    what I find even if it could be embarrassing to him.  But then =
I don't=20
    have a financial interest in putting others at risk just to try to =
make=20
    myself look good.>  > 
>>  =
> =20
    >  Rich>  > 
>>  =
> =20
    >    "Mike '/m'" <mike{at}barkto.com>">mailto:mike{at}barkto.com">mike{at}barkto.com>
wrote in =
message news:15seb1pu019=
glla3ph9mnje9h2rogh4mnh{at}4ax.com...> =20
    >  >    Oddly, I see
no mention of a race=20
    condition in the official Microsoft> 
> =20
    >    security bulletin that was
originally posted =
on=20
    December 20, 2001 and >  >  =
>   =20
    updated on May 09, 2003>  >  =
>    http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx"=
>http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx;=
> =20
    >  >>  >  =
>    =20
    /m>  > 
>>  >  =
>> =20
    >  >    On Mon, 20
Jun 2005 08:00:02 =
-0700, "Rich"=20
    <{at}> wrote:>  > 
>>  =
> =20
    >    >   A race =
condition.> =20
    >  >   
>>  > =20
    >   
>Rich>  > =20
    >   
>>  >  =
>   =20
    >  "Geo" <georger{at}nls.net>">mailto:georger{at}nls.net">georger{at}nls.net>
wrote in =
message news:42b699ed$2{at}w3.nls.net...=
> =20
    >  >   
>  Well what was it=20
    then?>  > 
>    =
>> =20
    >  >   
>  Geo.>  =
> =20
    >   
>    "Rich" <{at}>
wrote =
in=20
    message news:42b5feb2{at}w3.nls.net...>=
 =20
    >  >    =
>      =20
    It is not a buffer overflow.  It is not a buffer overrun.  =

    Neither.>  > 
>    =
>> =20
    >  >   
>   =20
Rich

------=_NextPart_000_001B_01C57773.472441B0--

--- BBBS/NT v4.01 Flag-5