Full Disclosure mailing list archives
Re: Publishing exploit code - what is it good for
From: Curt Sampson <cjs () cynic net>
Date: Fri, 1 Jul 2005 15:07:47 +0900 (JST)
Interesting, becuase this just hit me the other day. Wearing my sysadmin hat, I woke up one morning to find that the NetBSD package converters/xlreader had a vulnerability. Nobody seemed to have a patch for it, but looking at it, even with my rather limited level of C coding skill, I reckoned I could fix it. (Standard buffer overflow: replace sprintf with snprintf kinda thing.) So I did. Or at least, I think I did. I can't get my hands on a working exploit, so I don't feel truly comfortable that I did indeed fix the problem. Maybe to someone more familiar with C it would be proved fixed by inspection, but I don't feel that comfortable with it myself. I didn't really used to think that exploits were so useful until this. cjs -- Curt Sampson <cjs () cynic net> +81 90 7737 2974 http://www.NetBSD.org Make up enjoying your city life...produced by BIC CAMERA _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Publishing exploit code - what is it good for Curt Sampson (Jul 01)
- <Possible follow-ups>
- RE: Publishing exploit code - what is it good for Socrates (Jul 01)
- RE: Publishing exploit code - what is it good for Morales, David (Seta) (Jul 01)
- Re: Publishing exploit code - what is it good for Joachim Schipper (Jul 01)
- Re: Publishing exploit code - what is it good for ChayoteMu (Jul 02)
- RE: Publishing exploit code - what is it good for Harry Metcalfe (Jul 02)
- RE: Publishing exploit code - what is it good for wnorth (Jul 05)
- Re: Publishing exploit code - what is it good for Lionel (Jul 06)