oss-sec mailing list archives
Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less
From: Robert Watson <robertcwatson1 () gmail com>
Date: Mon, 17 Nov 2014 02:44:27 -0500
30+ years of programming Unix/Linux systems has taught me that old tools (like old cars) usually work very well for the intended purpose, but are far from as safe to use as we expect nowadays. All of these tools were written years ago for use in an environment where there was no such thing as "anonymous access." Yes, bad practices like shared logins were common. But there was still always someone to hold responsible. Most of the authors of these tools are long since retired and/or deceased. Thus, someone new must be found with sufficient interest to learn the software and correct these fuzzing-uncovered problems. It would be far more beneficial to "adopt" one of these "orphaned" tools that you'd like use. Then fork a new version, or an entirely new tool for the intended function, that incorporates the safety standards we expect. If every car on the road had to be kept upgraded to current safety standards, only the well-off would own cars. *Trust in truth keeps hope alive* * iCare for AffordableCare <http://www.nationalpartnership.org/issues/health/HIT/>* *robertcwatson1 () gmail com <robertcwatson1 () gmail com>* *www.docsalvage.info <http://www.docsalvage.info/>* *www.softwarerevisions.net <http://www.softwarerevisions.net/>* *www.CivicChorale.org <http://www.civicchorale.org/>* <http://www.charliecrist.com/> <https://www.healthcare.gov/> <http://www.wunderground.com/cgi-bin/findweather/getForecast?query=Tallahassee,%20FL> On Sun, Nov 16, 2014 at 6:10 PM, Robert Święcki <robert () swiecki net> wrote:
2014-11-16 21:43 GMT+01:00 Michal Zalewski <lcamtuf () coredump cx>:However, even if tools like file/ndisasm/gimp/readelf can be used by many (w/o strong system isolation boundaries) to analyze untrusted inputs (for reverse engineering, malware analysis and similar purposes) - I'd simply put a blame on those usersWell, it's always the easy option, but keep in mind that there are countless tutorials that tell people to use 'file' or 'strings' to examine sketchy file, or use tools such as objdump to do hobby forensics. We can blame the authors of the tutorials - but it goes back to a fairly fundamental problem: the use cases aren't completely crazy (nothing *fundamentally* wrong in using 'strings' on a file you don't trust, right?), and their unsafe design is a fairly counterintuitive property to laypeople and many experts alike [*]. So, for high-profile tools used in ways that are sort of plausible and probably common, we may just need to try & make them robust.Agreed.(But of course, I'd be pragmatic in drawing the line: the Mayhem fuzzing thing went completely overboard.)-- Robert Święcki
Current thread:
- Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Hanno Böck (Nov 16)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Robert Święcki (Nov 16)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Michal Zalewski (Nov 16)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Robert Święcki (Nov 16)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Robert Watson (Nov 16)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Robert Święcki (Nov 16)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Hanno Böck (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Raphael Geissert (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Hanno Böck (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Robert Święcki (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Michal Zalewski (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Raphael Geissert (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Raphael Geissert (Nov 18)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Jakub Wilk (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Hanno Böck (Nov 17)
- Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less Jakub Wilk (Nov 17)