Re: Untrusted fs and invalid filenames

[Stephan Mueller <stephan.mueller () atsec com>]

Am Montag, 14. März 2011, um 13:56:45 schrieb Dan Rosenberg:

Hi Dan,

> I'd like to add that while this kind of hardening would be nice in
> theory, there is little urgency in making these improvements since the
> proposed attack vectors are extremely limited.  As I see it, there are
> four scenarios where this might matter:

I am not so sure that all the following is unlikely:
> 1. An attacker convinces a victim to download an evil filesystem image
> and manually mount it.

I guess that is the most likely vector - how often did you download ISO images 
from somewhere - it is often for me?

How often did you get USB drives from somebody - it happens frequently?

How often did you mount them?

I guess, this happened often. The concern here is that most users are very 
unsuspecting of the discussed issue. Most people think that you should not 
execute files from unknown media. But hardly anyone thinks that simply 
mounting the media or listing directory contents would cause problems. At 
least that is what I have learned.

Ciao
Stephan