Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less

[Robert Święcki <robert () swiecki net>]

2014-11-16 21:43 GMT+01:00 Michal Zalewski <lcamtuf () coredump cx>:
> > However, even if tools like file/ndisasm/gimp/readelf can be used by
> > many (w/o strong system isolation boundaries) to analyze untrusted
> > inputs (for reverse engineering, malware analysis and similar
> > purposes) - I'd simply put a blame on those users
>
> Well, it's always the easy option, but keep in mind that there are
> countless tutorials that tell people to use 'file' or 'strings' to
> examine sketchy file, or use tools such as objdump to do hobby
> forensics.
>
> We can blame the authors of the tutorials - but it goes back to a
> fairly fundamental problem: the use cases aren't completely crazy
> (nothing *fundamentally* wrong in using 'strings' on a file you don't
> trust, right?), and their unsafe design is a fairly counterintuitive
> property to laypeople and many experts alike [*].
>
> So, for high-profile tools used in ways that are sort of plausible and
> probably common, we may just need to try & make them robust.

Agreed.

> (But of
> course, I'd be pragmatic in drawing the line: the Mayhem fuzzing thing
> went completely overboard.)


-- 
Robert Święcki