full-disclosure - Re: GAYER THAN AIDS ADVISORY #01: IE 5 remote code execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <40346F3A.9040408@nospam.wafel.org>
From: full-disclosure at nospam.wafel.org (Jorrit Kronjee)
Subject: Re: GAYER THAN AIDS ADVISORY #01: IE 5 remote
 code execution

Tim wrote:
>>Oh, give me a break. Some developer went, "Oh, hey, I'm not bounds
>>checking there. Okay, fix that," and the changes filtered out into
>>the release of IE. You don't release "security patches" except in
>>response to publication of a serious vulnerability, and especially
>>in response to a problem that's systemic. This is *a* buffer
>>overflow. Do we expect even Sun or Apple to tell us about every
>>buffer overflow they fix? Hell, do we expect Linux or NetBSD to do
>>so? C'mon, people. If you're going to be quoted for publication, try
>>to make statements reasonable to the actual importance of the issues
>>at hand.
> 
> 
> Say you are an engineer at a large car manufacturing company.  Suppose,
> 6 months after the 2004 model of your sedan goes out the door, you
> discover, as an engineer who helped build it, that the car's frame is
> flawed.  Suppose that it is so flawed that after 3 years, it may break
> due to normal use, potentially causing bad crashes.
> 
> Is it your moral obligation to notify customers?  Sure you are going to
> fix it in next year's model, that is a given.  But what about all those
> people with a potentially deadly model?
> 
> 
> Obviously, this is not the auto industry.  Some will argue that we are
> not talking about life-and-death situations here.  But the reality is,
> we are.  Software bugs can cause death, and have before, both on the
> small scale, and the large scale.  (can you say "power outage"?) As the
> world moves forward with "progress", it will become ever more important.
> It is about time that IT professionals realize this and start expecting
> quality out of the products they buy.
> 
> Hope that puts it into perspective for some people.
> 
> tim

I think we've heard the comparison with car manufacturers a dozen times, 
but i think this one is flawed. A buffer overflow is not triggered 
unless a malicious person does so. So a more fitting comparison would be 
if the brakes of your car were easily accessible to malicious persons, 
therefor causing a life-threatening situation.

Hope that puts it into perspective for you,

Jorrit