From: Tony Williams 

Geo. wrote:
> "Tony Williams"  wrote in message
> news:3DE7AA13.9070708{at}blarg.net...
>
>
>>>And how would you know what function to search for?
>>
>>The one with the known vulnerability - printf() in your example.
>
>
> Great, so what function was it in this latest patch for the ocx control with
> MS? Oh, you don't have the source so you don't know? How about any of the MS
> patches, do you know what functions to search for?
>

It wouldn't be too hard to find out from the documentation if it was a
public API function. All it takes is a stack trace on a program exhibiting
the vulnerability.

If it wasn't one of the API functions then nobody will be using it except
through another documented API function so the vulnerability can be
exploited via that call.

--
Tony

--- BBBS/NT v4.01 Flag-4