bugtraq - Re: Shoe 1.0 - Remote Lace Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 18 Jan 2005 12:15:24 -0700
From: Thomas Sutpen <sutpen@...il.com>
To: stonersavant <dank.krew@...il.com>
Cc: "announce@...0.org" <announce@...0.org>, dailydave@...unitysec.com,
        Nancy Kramer <nekramer@...dtheater.net>, bugtraq@...urityfocus.com,
        full-disclosure@...ts.netsys.com
Subject: Re: Shoe 1.0 - Remote Lace Overflow

On Tue, 11 Jan 2005 07:05:12 -0800, stonersavant <dank.krew@...il.com> wrote:
> I tested this in my lab. I'm happy to report that s10.5 Ninja Tabi
> boots appear to be unaffected by the vulnerability.

Unfortunately, this raises more questions than it creates answers.

For example, if the people of Japan, an island nation isolated until a
series of big wars in the 1600s, were capable of developing long
before external contact ethnic footwear in which this problem is not
endemic, who else has done so?  Is there any other ethnic footwear out
there that by design is resistant to this type of attack?

I suppose I could begin the list by contributing another solution.

Entry 1.  The Japanese - Tabi boots.
Entry 2.  The Dutch - Clogs.

These wooden devices couldn't be any less comfortable if one were to
hammer nails through the soles before putting them on.  And merchants
that sell them always try to bundle them as part of a package deal,
including a smoke and a pancake.  However, they seem immune to the
vulnerability.

Any other contributions?

Chrz,
TS
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html