I find it hard to buy Dullien's analysis that ASLR in Vista will stop Office zero-day bugs. The ASLR implementation in Vista is not very resilient -- it only randomizes the bases of certain system DLLs and not the rest of the loaded modules.

This means that today's attackers will still succeed t...

[ more ]