From: Glenn_Everhart at bankone.com (Glenn_Everhart@...kone.com)
Subject: And how long have buffer overflows been around?

There were rumors that the NT kernel was originally called Mica at DEC
and that the code was in fact brought bodily to Microsoft, having 
been originally designed to be a VMS followon. If that is true you could
say that the security design was in fact that of VMS V1, which dates
from about 1975, old enough to qualify. There was an ARPAnet before
there was an Internet. I recall seeing THAT around that time frame but
it was considered amazing to be able to telnet cross country at all then,
so people didn't worry too much about fancy security. Remember the flow
problems with the imps? Just getting things working at all was issue
enough.

-----Original Message-----
From: Ng, Kenneth (US) [mailto:kenng@...g.com]
Sent: Friday, February 27, 2004 8:46 AM
To: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] And how long have buffer overflows been
around?


What quantum universe is this guy coming from?  I don't know the start of
the internet, but the date on the telnet RFC 318 is   April 3, 1972 (
http://www.faqs.org/rfcs/rfc318.html )  According to Microsoft's own time
line ( http://www.microsoft.com/windows/WinHistoryProGraphic.mspx ) Windows
NT started in 1993.  Maybe they consider the start of the internet in Al
Gore terms?

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Edward W.
Ray
Sent: Thursday, February 26, 2004 7:51 PM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] And how long have buffer overflows been
around?


A lot longer than just before Windows 2003 release, but not according to
Security Architect and Chief Technology Officer of Microsoft's Security
Business Unit David Aucsmith:


"Windows 95 was written without a single security feature, he said, as it
was designed to be totally open to let users connect to other systems.
Furthermore, the security kernel of the Windows NT server software was
written before the Internet, and the Windows Server 2003 software was
written before buffer overflows became a frequent target of recent
attacks..."


The rest of the article can be found at
http://www.infoworld.com/article/04/02/24/HNunderattack_1.html


A little levity for today's discussion.

Edward W. Ray

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


*****************************************************************************
The information in this email is confidential and may be legally privileged.
It is intended solely for the addressee. Access to this email by anyone else
is unauthorized. 

If you are not the intended recipient, any disclosure, copying, distribution
or any action taken or omitted to be taken in reliance on it, is prohibited
and may be unlawful. When addressed to our clients any opinions or advice
contained in this email are subject to the terms and conditions expressed in
the governing KPMG client engagement letter.         
*****************************************************************************

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


**********************************************************************
This transmission may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you
**********************************************************************

Powered by blists - more mailing lists