full-disclosure - And how long have buffer overflows been aro und?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <9AD9D61578B84144912BCB44CBEF9EAD0700E623@usnssexc03.us.kworld.kpmg.com>
From: kenng at kpmg.com (Ng, Kenneth (US))
Subject: And how long have buffer overflows been aro
	und?

What quantum universe is this guy coming from?  I don't know the start of
the internet, but the date on the telnet RFC 318 is   April 3, 1972 (
http://www.faqs.org/rfcs/rfc318.html )  According to Microsoft's own time
line ( http://www.microsoft.com/windows/WinHistoryProGraphic.mspx ) Windows
NT started in 1993.  Maybe they consider the start of the internet in Al
Gore terms?

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Edward W.
Ray
Sent: Thursday, February 26, 2004 7:51 PM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] And how long have buffer overflows been
around?

A lot longer than just before Windows 2003 release, but not according to
Security Architect and Chief Technology Officer of Microsoft's Security
Business Unit David Aucsmith:

"Windows 95 was written without a single security feature, he said, as it
was designed to be totally open to let users connect to other systems.
Furthermore, the security kernel of the Windows NT server software was
written before the Internet, and the Windows Server 2003 software was
written before buffer overflows became a frequent target of recent
attacks..."

The rest of the article can be found at
http://www.infoworld.com/article/04/02/24/HNunderattack_1.html

A little levity for today's discussion.

Edward W. Ray

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

*****************************************************************************
The information in this email is confidential and may be legally privileged.
It is intended solely for the addressee. Access to this email by anyone else
is unauthorized. 

If you are not the intended recipient, any disclosure, copying, distribution
or any action taken or omitted to be taken in reliance on it, is prohibited
and may be unlawful. When addressed to our clients any opinions or advice
contained in this email are subject to the terms and conditions expressed in
the governing KPMG client engagement letter.         
*****************************************************************************