Re: Microsoft Office Excel 2010 memory corruption

[Julius Kivimäki <julius.kivimaki () gmail com>]

Would you consider software that is used to open local documents and
crashes when you feed it corrupt data defective?

2012/10/29 Jeffrey Walton <noloader () gmail com>

> On Mon, Oct 29, 2012 at 1:35 PM, Peter Ferrie <peter.ferrie () gmail com>
> wrote:
> > > How can i make sure a crash is not exploitable? (( The short answer is
> > > simple assume every crash is exploitable and just fix it.))
> >
> > No, it costs a lot of time and money to fix even one issue.
> > We don't want to waste it on something that isn't exploitable.
> There are at least four problems with this argument. First, the
> argument basically says "defective software is OK." I find that to be
> negligent (perhaps grossly negligent), and it sets off red flags for
> me.
>
> Second, if a shop did not get the basic coding correct, what
> credibility does the shop have when they claim its not security
> related and cannot be exploited. Often, the folks claiming something
> defective is OK are either too dumb or too ignorant to realize they
> are wrong. We saw the same with attacks on MD5 from the a number of
> folks, including the CAs.
>
> Third, its often easier to fix problems like this than spend the
> man-hours studying it. Architectural defects are a different story
> though.
>
> Fourth, the software does not meet basic merchanibility standards.
> Would you accept an auto defect where your windshield wipers did not
> work on occasion?
>
> If a shop gets it wrong too often, I ban the company's software. For
> example, I no longer suffer Adobe's bugs on my network because its not
> worth my time to shut down the vectors.
>
> Jeff
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/