Timeline for Determining vulnerable software on client machines
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 2, 2011 at 12:28 | comment | added | Tornike | As I wrote above, with local BOF exploits, IMHO there is no way to remotely determine which software and version does victim use, if software doesn't listen to any port, or send any packets. You need something to access remotely. But that's software independent, maybe users use multicast streams with VLC that will help you to determine version or you can use social engineering. I hope you get the point. | |
| Jun 2, 2011 at 9:00 | comment | added | Sonny Ordell | Well ignore the browser for a second...let's say a machine has Windows Media Player, MS Office, VLC, and Adobe Flash and Reader installed. All have had exploits in the past, but if all are up to date with patches should be fine. VLC had a vulnerability prior to versions 1.1.9 that would allow arbitrary code execution...going after the adobe products would be a better bet, but if there was a way to determining that VLC <= 1.1.9 was installed, the attacker would surely go for that. | |
| Jun 2, 2011 at 8:19 | history | answered | Tornike | CC BY-SA 3.0 |