bugtraq - Re[2]: Microsoft FTP Client Multiple Bufferoverflow Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 29 Nov 2007 16:18:25 -0800
From: "Matthew Leeds" <mleeds@...leeds.net>
To: "Steve Shockley" <steve.shockley@...ckley.net>,
	bugtraq@...urityfocus.com
Subject: Re[2]: Microsoft FTP Client Multiple Bufferoverflow
  Vulnerability

Given the past issues with .zip and .rar unpackers, unpacking an archive should be considered a risky activity. In some sense, opening, accessing, playing, or otherwise touching any file from an unknown source could be considered risky. The list of issues with media files, archive files, (or more accurately put, the applications that handle them) and the like is too long to recite, but informative.

----------
---Matthew
*********** REPLY SEPARATOR  ***********

On 11/29/2007 at 6:09 PM Steve Shockley wrote:

>Valdis.Kletnieks@...edu wrote:
>>> An attacker who can convince an user to extract a specially crafted
>>> archive can overwrite arbitrary files with the permissions of the user
>>> running gtar.  If that user is root, the attacker can overwrite any
>>> file on the system.
>> 
>> Apparently, somebody at FreeBSD thinks "can be exploited if you trick the
>> user into doing something" is a valid attack vector.
>
>The difference is that I'd be surprised when I got 0wned by unpacking an 
>archive, and not all that surprised when I got 0wned by running a random 
>executable (script) file.