4 ms·
It is Very Bad Indeed™. It is exploitable to get RCE, so actually worse in impact than both Heartbleed and goto fail. (Other lesser, but still very serious effe
by AlyssaRowan 12y ago
It is Very Bad Indeed™. It is exploitable to get RCE, so actually worse in impact than both Heartbleed and goto fail. (Other lesser, but still very serious effects like MITM are also implicated.)
IBM reported, MS did code review it seems, MS knew about some of these issues for ~6 months.
Patch immediately, people (like me) are running bindiff/etc and a public exploit won't be too far behind.
Not sure how far back it goes yet. All the way? The changes cover code going all the way back to the first SChannel code push, I think. (If XP is exploitable, this may be the XP killing vuln we've all been waiting for.)