Bugtraq mailing list archives
Re: DJB's students release 44 *nix software vulnerability advisories
From: Stephen Harris <bugtraq () spuddy org>
Date: Tue, 21 Dec 2004 15:22:21 -0500
On Mon, Dec 20, 2004 at 05:14:22PM -0600, Jonathan T Rockway wrote:
Two points. Regarding local versus remote, look at it this way: You have a 100% secure system. Then you install NASM. Now a user FROM THE NETWORK can send you some tainted assembly code for you to assemble and he can compromise your account. That is why it is considered remote. Local
And so we have a distinction without meaning. I could take a machine with no external connectivity beyond a single keyboard and monitor and by typing in a listing from a piece of paper use a command to reformat the system and lose all data. Remote exploit? By your usage of the term it is. In your example, a local user MUST take action in order to perform the exploit, therefore the exploit is local. Your "FROM THE NETWORK" is meaningless; it could be sent on floppy or printout or via psychic rays and get the same result.
Now in regards to full disclosure, I think you should all be happy that we bothered to tell you all about these exploits. We could have selfishly
And thus years of discussion on this, and other, lists about responsibility and concern goes out of the window. But that's a matter between you and your conscience. Be happy! -- rgds Stephen
Current thread:
- Re: DJB's students release 44 *nix software vulnerability advisories, (continued)
- Re: DJB's students release 44 *nix software vulnerability advisories Dave Holland (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Thor (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories David F. Skoll (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Jonathan Rockway (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Casper . Dik (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Michal Zalewski (Dec 23)
- Re: DJB's students release 44 *nix software vulnerability advisories Valdis . Kletnieks (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories laffer1 (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Jonathan Rockway (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Stephen Harris (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Raymond M. Reskusich (Dec 21)
- RE: DJB's students release 44 *nix software vulnerability advisories Devin Ganger (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Steven M. Christey (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories David Wagner (Dec 24)
- Re: DJB's students release 44 *nix software vulnerability advisories Steven M. Christey (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Crispin Cowan (Dec 23)
- RE: DJB's students release 44 *nix software vulnerability advisories Manning, Robert (Mission Systems) (Dec 22)
- RE: DJB's students release 44 *nix software vulnerability advisories Palmer, Paul (ISSAtlanta) (Dec 23)