lsass.exe: BUFOVRFLOW

polocanada · Jun 8, 2008

I just used Registry Monitor from Systernals, first time on this Vista PC. I got several lines with this:

XXXXXXXX lsass.exe:936 QueryValue HKLM\SECURITY\Policy\SecDesc\(Default) BUFOVRFLOW

Seems like lsass.exe causinig buffer overflow.

I am wondering whether this is a reason for concern? ANybody knows?

Thank you.

Bubba · Jun 8, 2008

polocanada said:

I am wondering whether this is a reason for concern? ANybody knows?

Thank you.
Click to expand...

Mark Russinovich gives a good write up concerning those buffer overflow entries from his program Regmon.

Buffer Overflows

Mark Russinovich said:

No, I’m not talking about the kind of buffer overflows that viruses can take advantage of to inject malicious code onto other systems, I’m talking about the kind that, if you use Filemon or Regmon, you’ve probably seen in their traces. If you’ve never noticed one, fire up one of those two tools and after collecting a log of system-wide activity, find an example by searching for “buffer overflow”. Here’s an example of file system buffer overflow errors:

Do these errors indicate a problem? No, they are a standard way for the system to indicate that there’s more information available than can fit into a requester’s output buffer. In other words, the system is telling the caller that if it was to copy all the data requested, it would overflow the buffer. Thus, the error really means that a buffer overflow was avoided, not that one occurred.
Click to expand...

....cont

nomarjr3 · Jun 8, 2008

You should consider using buffer overflow protection like Comodo Memory Firewall or Threatfire.

Log in or Sign up

lsass.exe: BUFOVRFLOW

polocanada Registered Member

Bubba Updates Team

nomarjr3 Registered Member

Log in or Sign up

lsass.exe: BUFOVRFLOW

polocanada Registered Member

Bubba Updates Team

nomarjr3 Registered Member

Useful Searches