Full Disclosure mailing list archives
RE: And how long have buffer overflows been around?
From: <Glenn_Everhart () bankone com>
Date: Fri, 27 Feb 2004 10:33:27 -0500
There were rumors that the NT kernel was originally called Mica at DEC and that the code was in fact brought bodily to Microsoft, having been originally designed to be a VMS followon. If that is true you could say that the security design was in fact that of VMS V1, which dates from about 1975, old enough to qualify. There was an ARPAnet before there was an Internet. I recall seeing THAT around that time frame but it was considered amazing to be able to telnet cross country at all then, so people didn't worry too much about fancy security. Remember the flow problems with the imps? Just getting things working at all was issue enough. -----Original Message----- From: Ng, Kenneth (US) [mailto:kenng () kpmg com] Sent: Friday, February 27, 2004 8:46 AM To: full-disclosure () lists netsys com Subject: RE: [Full-disclosure] And how long have buffer overflows been around? What quantum universe is this guy coming from? I don't know the start of the internet, but the date on the telnet RFC 318 is April 3, 1972 ( http://www.faqs.org/rfcs/rfc318.html ) According to Microsoft's own time line ( http://www.microsoft.com/windows/WinHistoryProGraphic.mspx ) Windows NT started in 1993. Maybe they consider the start of the internet in Al Gore terms? -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com]On Behalf Of Edward W. Ray Sent: Thursday, February 26, 2004 7:51 PM To: full-disclosure () lists netsys com Subject: [Full-disclosure] And how long have buffer overflows been around? A lot longer than just before Windows 2003 release, but not according to Security Architect and Chief Technology Officer of Microsoft's Security Business Unit David Aucsmith: "Windows 95 was written without a single security feature, he said, as it was designed to be totally open to let users connect to other systems. Furthermore, the security kernel of the Windows NT server software was written before the Internet, and the Windows Server 2003 software was written before buffer overflows became a frequent target of recent attacks..." The rest of the article can be found at http://www.infoworld.com/article/04/02/24/HNunderattack_1.html A little levity for today's discussion. Edward W. Ray _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html ***************************************************************************** The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. When addressed to our clients any opinions or advice contained in this email are subject to the terms and conditions expressed in the governing KPMG client engagement letter. ***************************************************************************** _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html ********************************************************************** This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you ********************************************************************** _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: And how long have buffer overflows been around? Tarun Bhushan (Feb 26)
- <Possible follow-ups>
- RE: And how long have buffer overflows been around? Glenn_Everhart (Feb 27)
- Re: And how long have buffer overflows been around? Valdis . Kletnieks (Feb 27)
- Re: And how long have buffer overflows been around? Nick FitzGerald (Feb 27)
- Re: And how long have buffer overflows been around? Valdis . Kletnieks (Feb 27)
- RE: And how long have buffer overflows been around? Vincent . Maes (Feb 27)
- RE: And how long have buffer overflows been around? Schmehl, Paul L (Feb 27)
- Re: And how long have buffer overflows been around? Nexus (Feb 27)