Bugtraq mailing list archives
Re: On classifying attacks
From: James Longstreet <jlongs2 () uic edu>
Date: Fri, 15 Jul 2005 18:40:42 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Jul 14, 2005, at 9:39 PM, Derek Martin wrote:
This kind of attack has a name already: it is a trojan horse.
<snip>
But is this a remote exploit?
No, it's not an exploit at all. Systems are not vulnerable to it unless a local user runs an executable. The only thing it exploits is trust of email (or similar vector).
Your example involving BIND is a good example of a true remote exploit. A local exploit is typically categorized as one that requires permissions on the system to begin with, and is used to gain elevated permissions (such as exploiting a setuid program, or causing root to write files through symlink race conditions).
This leaves one significant class of vulnerabilities, however. Let's imagine for a moment that there is a buffer overflow in libjpeg that allows an attacker to create a malicious JPEG which can cause any program using libjpeg to execute arbitrary code. This should be classified as a remote vulnerability. Users should be able to trust that opening a JPEG file will only cause certain code to run, namely decoding and displaying that JPEG. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin) iD8DBQFC2El6TYcj5d9bqjoRAsMcAKCKXn5l/B7WH4B49JIidvCXz3utRgCgxIBo xXQ3xMVvvTAZZtz7jXXd12o= =EhoG -----END PGP SIGNATURE-----
Current thread:
- On classifying attacks Derek Martin (Jul 15)
- RE: On classifying attacks Bryan McAninch (Jul 15)
- Re: On classifying attacks James Longstreet (Jul 16)
- Re: On classifying attacks Derek Martin (Jul 16)
- Re: On classifying attacks Godwin Stewart (Jul 18)
- Re: On classifying attacks James Longstreet (Jul 18)
- Re: On classifying attacks Adam Shostack (Jul 19)
- Re: On classifying attacks Mihai Amarandei-Stavila (Jul 18)
- Re: On classifying attacks Derek Martin (Jul 16)
- Re: On classifying attacks Crispin Cowan (Jul 18)
- Re: On classifying attacks Indigo Haze (Jul 16)
- <Possible follow-ups>
- Re: On classifying attacks Steven M. Christey (Jul 18)
- Re: On classifying attacks Dustin D. Trammell (Jul 19)
- RE: On classifying attacks Black, Michael (Jul 19)