|Main Archive Page > Month Archives > full-disclosure-uk archives|
I'd say that the DNS TID problem was a much more solvable problem than the problem Microsoft has with NTLM:
At least with the TID issue, a fix was identified that did not break interoperability with legacy systems. No such luck with NTLM. Since the only "fix" identified so far is completely disabling a protocol that's universally deployed, I'd say that just about pegs the PITA-meter.
From: Elazar Broad [mailto:email@example.com] Sent: Tuesday, November 25, 2008 11:59 PM To: firstname.lastname@example.org; email@example.com
Cc: firstname.lastname@example.org; email@example.com Subject: Re: [Full-disclosure] Microsoft takes 7 years to 'solve' a problem?!
-----BEGIN PGP SIGNED MESSAGE-----
Um, NTLM isn't the only 20 or so year old protocol to take the rap recently, I can think of a low numbered rfc, lets say 1034 and 1035. Hindsight is 20/20, and 20 years ago, who would have thought that a 16 bit number was way too small for DNS transaction id, the same "who would have though" goes for NTLM and the rest. Lets face it, protocol design bugs suck, and to completely replace a widely used protocol ranks pretty high in the PiTA hall of fame...
On Tue, 25 Nov 2008 05:25:57 -0500 Eric Rachner <firstname.lastname@example.org>
>Hey, kid -
>If you've got any better ideas about how to fix NTLM, the industry
>& waiting to hear them.
>The fact is, NTLM is an old & busted protocol that happens to be
>everywhere*, and there's no way to fix it without breaking
>with, oh, just the entire installed base. I was happy to see MS08-
>because the technique it implements is better than nothing - it
>nice, clever way to reduce the exploitability of the issue without
>Don't bother telling us all how M$ should just bite the
>bullet and turn NTLM off - that's been an option for users,
>speaking, since about the time Windows Kerberos support became
>practically speaking, nobody seems to be turning NTLM off here in
>On Tue, Nov 25, 2008 at 7:44 AM, Memisyazici, Aras <email@example.com>
>> <snip:: taken from MSRC Blog:
>> What we released today with MS08-068 is that security update. It
>> the SMBRelay issue (discovered in 2001) does so in a way that
>> the negative impact on applications that we originally believed
>> this issue would have.
>> So... Hmm... I wonder what would happen if the rest of the world
>> suit with M$' approach, and took 7 years to "fix" an issue in
>order to "not
>> cause a significant impact"...
>> Ppl: Hey Ford, if one brute-forces the keyless entry on the
>> car explodes...
>> Ford: well... I'll offer you three choices, two immediately, and
>> one 7 yrs later. You can either not use the keyless entry system
>> you some shiny duck-tape to cover it) or you can use the
>> system which requires that you have a knub... So those who have
>arms & legs
>> can't use the system... (btw this will give birth to a whole new
>> that will allow ppl to pay money for a product that fakes a knub
>> with appendages) But it's biometric & cool this way! Or you can
>wait for 7
>> years and we'll release a non-exploding version of the keyless-
>> OK... Maybe I'm going a bit extreme, but WTH?! Am I the only one
>> interpreting this, this way? Really? When has releasing a
>solution to a
>> problem 7 years later ever been acceptable?
>> Jus' sayin' ...
>> Aras 'Russ' Memisyazici
>> Systems Administrator
>> Virginia Tech
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0
-----END PGP SIGNATURE----- -- Earn more money. Click here to be certified as a personal trainer. http://tagline.hushmail.com/fc/PnY6qxuDvSM8g0rMP8MYY39fxdedfaeIAefWGHzD14thA8Zv41cU1/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/