full-disclosure - Re: GAYER THAN AIDS ADVISORY #01: IE 5 remote code execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040218165506.GB28756@sherohman.org>
From: esper at sherohman.org (Dave Sherohman)
Subject: Re: GAYER THAN AIDS ADVISORY #01: IE 5 remote code execution

On Wed, Feb 18, 2004 at 08:29:49AM -0500, gabriel rosenkoetter wrote:
> Oh, give me a break. Some developer went, "Oh, hey, I'm not bounds
> checking there. Okay, fix that," and the changes filtered out into
> the release of IE. You don't release "security patches" except in
> response to publication of a serious vulnerability, and especially
> in response to a problem that's systemic. This is *a* buffer
> overflow. Do we expect even Sun or Apple to tell us about every
> buffer overflow they fix? Hell, do we expect Linux or NetBSD to do
> so?

Funny that you should ask that on the same day that I (and this list)
have received no fewer than four notices from Debian that they've
released new versions of various kernel packages to fix *a* local
root hole caused by not checking a function's return value.

So, yes, I do expect my Linux distributor to tell me about every
buffer overflow they fix - and they do, either with mail from the
debian-security list or with Changelogs included in the packages.

-- 
The freedoms that we enjoy presently are the most important victories of the
White Hats over the past several millennia, and it is vitally important that
we don't give them up now, only because we are frightened.
  - Eolake Stobblehouse (http://stobblehouse.com/text/battle.html)