bugtraq - Re: Misinformation in Security Advisories (ASN.1)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200402161815.i1GIF6h3005006@turing-police.cc.vt.edu>
Date: Mon, 16 Feb 2004 13:15:06 -0500
From: Valdis.Kletnieks@...edu
To: John Compton <john_compton24@...oo.com>
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: Re: Misinformation in Security Advisories (ASN.1)

On Mon, 16 Feb 2004 08:42:23 PST, John Compton <john_compton24@...oo.com>  said:

> You are likely not going to see any more than the DoS exploit that has
> already come out. For those of you interested in the technical explanation of
> why, it is included below (it's honestly beyond my complete understanding).
> Most of the security researchers I've spoken to agree with this assessment and
> the information below.

Now which should I believe here:

1) Your proof of why it's not possibly exploitable when you yourself admit you don't
understand it?

2) The possibility that some clever black hat fully understands the challenges
and has found a way around it? (Say, wasn't there another exploit a while ago
that managed to work around that "exception handlers don't use the heap"
problem?)

Content of type "application/pgp-signature" skipped