<<< Date Index >>>     <<< Thread Index >>>

Re: Microsoft FTP Client Multiple Bufferoverflow Vulnerability



Valdis.Kletnieks@xxxxxx wrote:
An attacker who can convince an user to extract a specially crafted
archive can overwrite arbitrary files with the permissions of the user
running gtar.  If that user is root, the attacker can overwrite any
file on the system.

Apparently, somebody at FreeBSD thinks "can be exploited if you trick the
user into doing something" is a valid attack vector.

The difference is that I'd be surprised when I got 0wned by unpacking an archive, and not all that surprised when I got 0wned by running a random executable (script) file.