I Don't have 22 years experience, but did you also happen to read the writeup yesterday? And catch this in today's article as well?

<i>"The technique works against Microsoft's RegEdit utility, but other system utilities, such as Reg.exe and the Microsoft Configuration Editor, are not affected, the software giant stated."</i>

It would seem to me that by simply altering the reditor you could solve this issue. I also seem to recall at one time openly reading about this in the MSDN.

<i>"The technique involves using a registry key whose name is longer than 256 bytes."</i>

Wouldn't this be fix by patching whatever memory limitation was implemented at design time, I mean come on PC's now come with at least 512 mb ram now, you telling me they can't handle a filename with 256 chars?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11300/32373#32373