RE: Buffer Overruns

["LeGrow, Matt" <Matt_LeGrow () NAI com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



> -----Original Message-----
> From: Matt Curtin [mailto:cmcurtin () interhack net]
> Sent: Friday, December 17, 1999 10:20 PM
> To: Michael Kelly
> Cc: Firewalls
> Subject: Re: Buffer Overruns
>
>
> > > > > > On Fri, 17 Dec 1999 06:16:32 -0500,
> > > > > > Michael Kelly <michaelkelley () home com> said:
>
> Michael>  I really feel silly asking this, but; Can these buffer
> Michael> overrun bugs penetrate firewalls? I'm trying to convince
> the Michael> boss to ditch IE in favor of Netscape. (which is only
> Michael> slightly better)  
>
> A buffer overrun problem is possible anytime that something can
> give more input than the listener is expecting and will properly
> handle.  
>
> That means it will traverse all protocols, network architecture
> components, applications, platforms, etc., that are in the 
> middle.  If 
> the source of the data can give more than the receiver can
> reasonably handle, it's vulnerable.  A firewall will offer no
> protection.  

I think its important to note here that a great many of the buffer
overrun problems in browsers actively exploited today are due to
problems with function calls inside of scripting languages processed
in the browser.  Most firewall proxies have Javascript/ActiveX
filtering capabilities, and will prevent such code from being
executed on the client.  Not a complete solution, but it will help
solve some of the issues.

Matt LeGrow
Network Associates, Inc.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Note: Opinions expressed herein are most certainly NOT that of my
employer:-)

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1
Comment: Crypto Provided by Network Associates <http://www.nai.com>

iQA/AwUBOF5Op/bW52zw8/NBEQJYiwCgkAz69pm+LSPB7VSyjvUzhRj+FHUAniWS
bQUT1T26+6YbiswR37JTYhm6
=7GoO
-----END PGP SIGNATURE-----