Re: Buffer Overruns

[Vin McLellan <vin () shore net>]

        It there something in the emergence of a popular Internet, or some
other timely aspect in the industry's evolution, that has brought to light
the vulnerabilities associated with buffer overruns in recent years? 

        Maybe some shift in program design or programming engineering
practice?  What left so many of these vulnerabilities unexposed and their
risks unappreciated for so many years?

        Sometimes even in <ahem> widely distributed source code.

        _Vin



At 05:28 PM 12/17/99 -0500, Steven M. Bellovin wrote:
> In message <385A1B90.E2213122 () home com>, Michael Kelly writes:
> >  I really feel silly asking this, but;
> >  Can these buffer overrun bugs penetrate firewalls? I'm trying to
> > convince the boss to ditch IE in favor of Netscape. (which is only
> > slightly better)
>
> Yes, some buffer overruns can penetrate firewalls.
>
> Fundamentally, firewalls cannot protect you against attacks at a higher level 
> of the protocol stack than the firewall operates at.  If you allow http and 
> html through your firewall, and there's a bug in the program at your end that 
> processes the http and html -- yes, you're vulnerable.
>
> This isn't a new issue; see, for example, CERT Advisory CA-98.10, CA-97.05, 
> and many others.
>
>               --Steve Bellovin