Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass

[acid]

Published 28th January 2005.
Problem
In October 2004 it was discovered by MaxPatrol team that it is possible to defeat Microsoft® Windows® XP SP2 Heap protection and Data Execution Prevention mechanism. As a result it is possible to implement:

1. Arbitrary memory region write access (smaller or equal to 1016 bytes)
2. Arbitrary code execution
3. DEP bypass.

Details are described in the article by our expert: PDF format, HTML format.
Solution
As a temporary security measure we've developed simple utility PTmsHORP, which allows restriction of lookaside list creation, governed by a special global flag.
Download PTmsHORP (21 Kb)
During the first execution this program shows the list of applications which already have this flag set. In order to activate this safety flag for other applications you just need to add the name of the executable file to the list. Any time you can review or modify the list of protected applications by running PTmsHORP again.
Warning. The flag, while enabled, may decrease the application performance.

http://www.maxpatrol.com/ptmshorp.asp