Re: Cisco IOS Vulnerablity

[John Ladwig <John.Ladwig () CSU MNSCU EDU>]

That was my take on it, too.  Seems like it shoulda been a press
release, *unless* there's some nasty unannounced heap overflow in the QA
pipeline.

They coulda been clearer, for sure.

    -jml

> > > flynngn () JMU EDU 11/03/05 7:40 AM >>>
Arturo Servin wrote:

>    Yes. It's going to be a big one.

Unless I missed something, Cisco altered an
architecture design so that it would be harder
to exploit a heap overflow related defect should
one be found (or a past one not patched).

I don't see where they announced a new defect
allowing an exploit to produce a heap overflow.

It appears comparable to adding stack protection
in Windows XP sp2 although that was for a
different type of overflow. Its a strengthening
measure more than a patching measure.

Am I misinterpreting the bulletin?


--
Gary Flynn
Security Engineer
James Madison University
www.jmu.edu/computing/security