full-disclosure - Web sites compromised by IIS attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200407021936.i62JaF6Y008548@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Web sites compromised by IIS attack 

On Thu, 01 Jul 2004 19:57:48 PDT, Denis Dimick said:

> I do find it "funny" that sendmail and BIND have been thrown out in the 
> e-mails (don't think it was you) But these two applications are some of 
> the most buggy bits of code ever written.

Yes, they've had bugs.  The point is that they are *not* the buggiest
bits of code ever written.  Remember that we're talking about programs
that provide a complicated service to network clients, and thus prone to
all sorts of odd race condition bugs that might crop up on some system
or other.  And then there's the fact that a lot of bugs get found in those
packages just because a lot of people *look* at that code.

Surf over to sourceforge, grab 8 or 10 projects at random, and
start auditing and bug counting.  Or think about all the postings
we've seen that say "I looked at it for 15 minutes, found 3 exploitable
format string bugs and 5 buffer overruns, got bored and gave up".

If you think Sendmail and Bind are the buggiest, you've obviously not
been around long enough to see some of the *truly* ugly and just plain
screwed up code out there.  I suspect that a ton of bugs lurk in
procmail, only concealed by the fact that anybody who reads the source code
out loud has to make a saving throw or accidentally summon He Who
Must Not Be Named, or some other creeping-horror C'thulhu creature...

Or look at the Javascript and VB and PHP code out there sometime, and
ask what would happen if the authors of THOSE tried writing a 90K or
200K line piece of software, armed only with caffeine, delusions about
their ability, and a 'Learn Foo in 21 Days" book...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040702/e18f9102/attachment.bin