bugtraq - Re: DJB's students release 44 *nix software vulnerability advisories

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 20 Dec 2004 17:14:22 -0600 (CST)
From: Jonathan T Rockway <jrockw2@....edu>
To: bugtraq@...urityfocus.com
Subject: Re: DJB's students release 44 *nix software vulnerability advisories

Two points.

Regarding local versus remote, look at it this way:  You have a 100%
secure system.  Then you install NASM.  Now a user FROM THE NETWORK can
send you some tainted assembly code for you to assemble and he can
compromise your account.  That is why it is considered remote.  Local
would mean that I, the attacker, need an account on the target machine to
compromise the target account.  In this nasm case, I do not need an
account.  That is why the wording "remote" was chosen.

Now in regards to full disclosure, I think you should all be happy that we
bothered to tell you all about these exploits.  We could have selfishly
used them to compromise machines, but instead we wrote them up and mailed
them off to the users and the authors!  That is very nice of us.

If you would like notification sooner than the "public", find the exploit
yourself.  If I can find them, then surely anyone can.

Regards,
-- 
Jonathan Rockway <jrockw2@....edu>