full-disclosure - And how long have buffer overflows been aro

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: avalon at caligula.anu.edu.au (Darren Reed)
Subject: And how long have buffer overflows been aro

Maybe they're referring to Windows NT having a heritage of core design
from people who worked on VMS (which does predate the Internet.)

In some mail from "Ng, Kenneth (US)", sie said:
> 
> What quantum universe is this guy coming from?  I don't know the start of
> the internet, but the date on the telnet RFC 318 is   April 3, 1972 (
> http://www.faqs.org/rfcs/rfc318.html )  According to Microsoft's own time
> line ( http://www.microsoft.com/windows/WinHistoryProGraphic.mspx ) Windows
> NT started in 1993.  Maybe they consider the start of the internet in Al
> Gore terms?
> 
> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Edward W.
> Ray
> Sent: Thursday, February 26, 2004 7:51 PM
> To: full-disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] And how long have buffer overflows been
> around?
> 
> 
> A lot longer than just before Windows 2003 release, but not according to
> Security Architect and Chief Technology Officer of Microsoft's Security
> Business Unit David Aucsmith:
> 
> 
> "Windows 95 was written without a single security feature, he said, as it
> was designed to be totally open to let users connect to other systems.
> Furthermore, the security kernel of the Windows NT server software was
> written before the Internet, and the Windows Server 2003 software was
> written before buffer overflows became a frequent target of recent
> attacks..."
> 
> 
> The rest of the article can be found at
> http://www.infoworld.com/article/04/02/24/HNunderattack_1.html
> 
> 
> A little levity for today's discussion.
> 
> Edward W. Ray
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> 
> *****************************************************************************
> The information in this email is confidential and may be legally privileged.
> It is intended solely for the addressee. Access to this email by anyone else
> is unauthorized. 
> 
> If you are not the intended recipient, any disclosure, copying, distribution
> or any action taken or omitted to be taken in reliance on it, is prohibited
> and may be unlawful. When addressed to our clients any opinions or advice
> contained in this email are subject to the terms and conditions expressed in
> the governing KPMG client engagement letter.         
> *****************************************************************************
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>