Re: DJB's students release 44 *nix software vulnerability advisories

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: DJB's students release 44 *nix software vulnerability advisories
From: "milw0rm Inc." <milw0rm@xxxxxxxxx>
Date: Tue, 21 Dec 2004 14:34:20 -0600
Cc: Jonathan T Rockway <jrockw2@xxxxxxx>
Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=RNR8cF/IFn9FbOZ2LXasMXDEoZgXzvofdL2E2nETrga3mwUI17MtOsPhrUW3TW6x8Xkp2X9cbeO53fdnMNixA9LSSo/DyD0QVLVbwr2E3Qm9xtqMy5fE6FINW8IKWAx/MFlSPg2GDF0cqlPi2GkGUVeNV9uEQgx2MbJKSHQccM4=
In-reply-to: <Pine.A41.4.58.0412201706570.241672@xxxxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <Pine.A41.4.58.0412201706570.241672@xxxxxxxxxxxxxxxxx>
Reply-to: "milw0rm Inc." <milw0rm@xxxxxxxxx>

/* 
Two points.
Regarding local versus remote, look at it this way:  You have a 100%
secure system.  Then you install NASM.  Now a user FROM THE NETWORK can
send you some tainted assembly code for you to assemble and he can
compromise your account.
*/ 

quote "for you to assemble"

Its a user error.  Your not remotely exploiting anything but the trust
from the user.

//str0ke

Follow-Ups:
- Re: DJB's students release 44 *nix software vulnerability advisories
  - From: Jack Lloyd
- Re: DJB's students release 44 *nix software vulnerability advisories
  - From: Antoine Martin

References:
- Re: DJB's students release 44 *nix software vulnerability advisories
  - From: Jonathan T Rockway

Prev by Date: phpBB Worm
Next by Date: SUSE Security Announcement: various kernel problems (SUSE-SA:2004:044)
Previous by thread: Re: DJB's students release 44 *nix software vulnerability advisories
Next by thread: Re: DJB's students release 44 *nix software vulnerability advisories
Index(es):
- Date
- Thread