Bugtraq mailing list archives
Re: [Full-disclosure] 0day: PDF pwns Windows
From: Chad Perrin <perrin () apotheon com>
Date: Thu, 20 Sep 2007 12:34:50 -0600
On Fri, Sep 21, 2007 at 10:24:40AM -0400, Steven Adair wrote:
Not in my book. I guess the people on this list are working off too many different definitions of 0day. 0day to me is something for which there is no patch/update at the time of the exploit being coded/used. So if I code an exploit for IE right now and they don't patch it until April September 2008, it's a 0day exploit for a year. It's not necessarily new and it doesn't have to be used maliciously. If I code an exploit (for which there is no patch) and use it on my own servers, does that mean it's not 0day? I don't think so. If my WordPress blog gets owned by pwnpress, that's not 0day.. there's patches/updates for everything on there. It just makes me an idiot for not upgrading. Now if I get hit with some WP exploit that's not patched, then that's another [0-day] story.
The reason malicious use before there's a patch is significant is that it indicates a greater risk profile for users of the software in question. If it's being actively used to compromise systems, you can't just sit around waiting for a patch and expect to call your systems "secure" in any sense of the term: you have to find a work-around, or remove the vulnerable systems from the environment in which they're vulnerable (normally, this means "the Internet"). That's why the term zero day is important, and why it should not be misused to refer to something demonstrated in a lab somewhere but not publicly disclosed in any detail. That's why it's important to differentiate from exploits "in the wild" and discovered vulnerabilities or proofs of concept. -- CCD CopyWrite Chad Perrin [ http://ccd.apotheon.org ] Baltasar Gracian: "A wise man gets more from his enemies than a fool from his friends."
Current thread:
- 0day: PDF pwns Windows pdp (architect) (Sep 20)
- Re: 0day: PDF pwns Windows Gadi Evron (Sep 20)
- Re: 0day: PDF pwns Windows Crispin Cowan (Sep 21)
- Re: [Full-disclosure] 0day: PDF pwns Windows Steven Adair (Sep 21)
- Re: [Full-disclosure] 0day: PDF pwns Windows Chad Perrin (Sep 21)
- Re: [Full-disclosure] 0day: PDF pwns Windows Wayne D. Hoxsie Jr. (Sep 21)
- Re: [Full-disclosure] 0day: PDF pwns Windows bugtraq (Sep 21)
- Re: 0day: PDF pwns Windows Crispin Cowan (Sep 21)
- Re: [Full-disclosure] 0day: PDF pwns Windows coderman (Sep 21)
- Re: 0day: PDF pwns Windows Casper . Dik (Sep 21)
- Re: 0day: PDF pwns Windows J. Oquendo (Sep 21)
- Re: 0day: PDF pwns Windows Gadi Evron (Sep 20)
- Re: 0day: PDF pwns Windows Crispin Cowan (Sep 24)
- Re: 0day: PDF pwns Windows Chad Perrin (Sep 24)
- Re: 0day: PDF pwns Windows Crispin Cowan (Sep 24)
- Re: [Full-disclosure] 0day: PDF pwns Windows J. Oquendo (Sep 25)
- Re: 0day: PDF pwns Windows Lamont Granquist (Sep 25)