malcolmst

4 ms·

1. 1.▲
   by malcolmst 5y ago

   I was trying to use this same vuln for information disclosure since it also has an out-of-bounds read due to that lack of validation, but couldn’t get the extra data to be transferred back to the server. Would’ve been a nice way to defeat A
2. 2.▲
   by malcolmst 5y ago

   There was apparently also a similar vulnerability that someone else recently found in smart card redirection https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-at...
3. 3.▲
   by malcolmst 5y ago

   It doesn’t actually have to transfer all 4GB, since you’re just spoofing a header to claim that 4GB is available. The actual payload can be much smaller (like a few kB)