Bugtraq mailing list archives
Re: DJB's students release 44 *nix software vulnerability advisories
From: Jack Lloyd <lloyd () randombit net>
Date: Tue, 21 Dec 2004 16:58:48 -0700
On Tue, Dec 21, 2004 at 02:34:20PM -0600, milw0rm Inc. wrote:
/* Two points. Regarding local versus remote, look at it this way: You have a 100% secure system. Then you install NASM. Now a user FROM THE NETWORK can send you some tainted assembly code for you to assemble and he can compromise your account. */ quote "for you to assemble" Its a user error. Your not remotely exploiting anything but the trust from the user. //str0ke
Would you also argue that if someone views a web page and is compromised because of a bug in the HTML parser of their web browser, it is their fault? Certainly, assembling and then executing code of unknown provenence is a dumb idea. But at the point you assemble it, it is just ASCII text. There is a big difference between running code that you don't know, and running code you do know on potentially malicious data. The first might be asking for it, but you do the second every time you connect to a network. Jack
Current thread:
- Re: DJB's students release 44 *nix software vulnerability advisories, (continued)
- Re: DJB's students release 44 *nix software vulnerability advisories D. J. Bernstein (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories David Eisner (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Crispin Cowan (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories D. J. Bernstein (Dec 23)
- Re: DJB's students release 44 *nix software vulnerability advisories Crispin Cowan (Dec 24)
- Message not available
- Re: DJB's students release 44 *nix software vulnerability advisories Crispin Cowan (Dec 23)
- Re: DJB's students release 44 *nix software vulnerability advisories milw0rm Inc. (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Antoine Martin (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Chris Paget (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Jack Lloyd (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Jonathan Rockway (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Casper . Dik (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Michal Zalewski (Dec 23)
- Re: DJB's students release 44 *nix software vulnerability advisories Jonathan Rockway (Dec 22)