bugtraq - Re: Shoe 1.0 - Remote Lace Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 25 Dec 2004 16:49:08 -0700
From: Thomas Sutpen <sutpen@...il.com>
To: "announce@...0.org" <announce@...0.org>
Cc: dailydave@...unitysec.com, bugtraq@...urityfocus.com,
        full-disclosure@...ts.netsys.com
Subject: Re: Shoe 1.0 - Remote Lace Overflow

On Wed, 22 Dec 2004 11:20:45 -0500, announce@...0.org <announce@...0.org> wrote:
[...]
>  Vulnerable Sizes:
>  -----------------
>  6 through 13. Other sizes may be vulnerable, but were unavailable for testing.

Cursory note:  The guy with the size 13s must get all the chicks.  You
know what they say ....

[...]

>  Fix:
>  ----
>  Do not wear untrusted shoes sent to you. Other possible workarounds include
>  sandals (aka. flip-flops). These are a good work-around and are widely
>  available for those concerned about their security.

Merrell also makes a "Jungle Moc" that is a mitigating factor to this
vulnerability.  All shoes of similar "Moccasin" styles, as well as
Cowboy Boots, also seem to be unaffected.  Cowboy Boots with spurs
seem to add an additional layer of security, as well as cool points.

Review of their website seems to indicate that they're going to be
discontinuing the line, though.  So, with Boxing Day tommorrow, I'd
recommend snapping up a few pairs as a cautionary posture against the
possibility of future attacks.

[...]

TS
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html