bugtraq - Re: eSafe: Could this be exploited?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <410A4070.22467.66CC6825@localhost>
Date: Fri, 30 Jul 2004 12:34:56 +1200
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: bugtraq@...urityfocus.com
Subject: Re: eSafe: Could this be exploited?

Kev Ford wrote:

> Just an idle thought, but what about scripting? Would it be possible to 
> get some simple scripts through simply by making a large portion of the 
> end of the message useless comment fields? Maybe even a worm that 
> rewrites this 'noise' every time to make a moving target?

Yep, but it need not even be that deliberate.

Windows VBS with its ever so forgiving "resume next" "error handler", 
and some other "resilient" scripting languages (such as mIRC script), 
means that even some badly truncated malware can be executed 
"successfully", so long as the "important" part(s) of its functionality 
are nearer the beginning of the script code than the end.  Scripts in 
such languages that get rogered through partial transmission (this was 
very common with early mIRC script viruses) can keep on going in their 
new, truncated forms until they finally get chopped before the minimal 
code point that makes them replicative.

And yes, we have seen this happen in the wild many times already.

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854