Bugtraq mailing list archives
RE: DJB's students release 44 *nix software vulnerability advisories
From: "Devin Ganger" <DevinG () 3sharp com>
Date: Tue, 21 Dec 2004 13:20:09 -0800
Jonathan T Rockway writes:
Regarding local versus remote, look at it this way: You have a 100% secure system. Then you install NASM. Now a user FROM THE NETWORK can send you some tainted assembly code for you to assemble and he can compromise your account. That is why it is considered remote. Local would mean that I, the attacker, need an account on the target machine to compromise the target account. In this nasm case, I do not need an account. That is why the wording "remote" was chosen.
By that logic, *no* exploit can ever be considered local. A truly remote exploit doesn't rely on manual interaction from a local user on the system.
Now in regards to full disclosure, I think you should all be happy that we bothered to tell you all about these exploits. We could have selfishly used them to compromise machines,
When you're trying to argue that your actions were ethical and moral, pointing out that you could have committed crimes isn't the way to do it.
but instead we wrote them up and mailed them off to the users and the authors! That is very nice of us.
No, it's the absolute minimum level of ethical behavior one expects from serious security researchers. Nothing nice about it.
If you would like notification sooner than the "public", find the exploit yourself. If I can find them, then surely anyone can.
One day, when you are writing software for distribution, someone will find an error in your code. When that day comes, remember this attitude. While those who discover those bugs and exploits in your software have no obligation to give you advanced warning of your bugs, I'm certain you'd be grateful to have that warning so you have time to fix the bug before word goes public. -- Devin L. Ganger Email: deving () 3sharp com 3Sharp LLC Phone: 425.882.1032 x 109 15311 NE 90th Street Cell: 425.239.2575 Redmond, WA 98052 Fax: 425.702.8455
Current thread:
- Re: DJB's students release 44 *nix software vulnerability advisories, (continued)
- Re: DJB's students release 44 *nix software vulnerability advisories Thor (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories David F. Skoll (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Jonathan Rockway (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Casper . Dik (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Michal Zalewski (Dec 23)
- Re: DJB's students release 44 *nix software vulnerability advisories Valdis . Kletnieks (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories laffer1 (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Jonathan Rockway (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Stephen Harris (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Raymond M. Reskusich (Dec 21)
- RE: DJB's students release 44 *nix software vulnerability advisories Devin Ganger (Dec 21)
- Re: DJB's students release 44 *nix software vulnerability advisories Steven M. Christey (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories David Wagner (Dec 24)
- Re: DJB's students release 44 *nix software vulnerability advisories Steven M. Christey (Dec 22)
- Re: DJB's students release 44 *nix software vulnerability advisories Crispin Cowan (Dec 23)
- RE: DJB's students release 44 *nix software vulnerability advisories Manning, Robert (Mission Systems) (Dec 22)
- RE: DJB's students release 44 *nix software vulnerability advisories Palmer, Paul (ISSAtlanta) (Dec 23)