Jorgensen.org.uk

Although I am a Linux system administrator/MySQL DBA by trade, I do have the misfortune of having to maintain a windows server as part of my job. This is not something I enjoy...

Today I was presented with this gem:

Basically the server was due an upgrade. Not unusual, it happens a couple of times a week. Being the thorough system admin, I decided to see what wonders Microsoft had now decided to release upon us. Not surprisingly, there was a security update an outdated bit of software we use: Exchange Server 2003...

I was curious, and followed the link to see what horrors this was claiming to fix. After all, security falls in my area here. Lo and behold: IE blocks such information!? Apparantly access to such information is deemed insecure? Surely, this will not deter anybody from finding out about how to exploit the security problem. But it might stop somebody from installing the fix...

Many programming languages nowadays have concept of Exception Handling: Constructs where the normal program flow is redirected based on signals or events. Generally, such contructs are intended to perform error handling rather than letting the program terminate abruptly.

Let's take an example in e.g. Java. Imagine that this code is part of a program that produces some popular report for the finance department:

public void doSomething() {
    SomeObject so = new SomeObject();
    try {
        int  status;
        so.setSomething("foo","bar");
        status = so.someMethod("Hello World");
        if (status == SomeObject.OK) {
            String response = so.getResponseDetails();
            so.saveResponse(response);
        } 
    } catch (IOException e) {
        e.printStackTrace();
    }
}

For the untrained eye, this code looks correct.

But look again. Can you see why this piece of code is a undiscovered problem waiting to catch you out?