Date: Thu Sep  8 18:06:53 2005
From: andre.ludwig at gmail.com (Andre Ludwig)
Subject: Security Hole Found In Dave's Sock

Please note that the following attack vector may be present in any and
all "shoe" like devices and systems.

http://www.0x90.org/releases/laces0dayAdv.txt

 Shoe 1.0 - Remote Lace Overflow
 --------------------------------------------

 This Vulnerability is in reference to the new class of remote vulnerabilities 
 indicated in: 
 http://www.securityfocus.com/archive/1/385078/2004-12-19/2004-12-25/2
 [Please read that first] 

 Discovery Credited To:
 ----------------------
 	freshman - 0x90.org
  	wxs      - 0x90.org
  	txs      - 0x90.org

 Greets:
 -------
  Jonathan T. Rockway for being the smartest man alive.

 Description:
 ------------
 A remote shoe vulnerability exists that could allow for remote tripping and 
 possible exposure of sensitive data to the pavement.

 Scope:
 ------
 REMOTE

 Severity:
 ---------
 Hyper-Critical. This needs no explanation.

 Vulnerability:
 --------------
 Failure to properly tie your shoe could result in tripping and a possible 
 broken face upon sudden deceleration when hitting the pavement.

 Vulnerable Sizes: 
 -----------------
 6 through 13. Other sizes may be vulnerable, but were unavailable for testing.

 Exploitation:
 -------------
 You have a 100% secure walking system - you do not fall down, or trip over 
 your own laces.  A remote attacker could determine your shoe size by reading 
  your livejournal FROM THE NETWORK and could MAIL YOU a shoe with extra long 
 laces.  You put the shoe on without tying it properly and suddenly are exposed
 to a REMOTE shoe vulnerability!

 Fix:
 ----
 Do not wear untrusted shoes sent to you. Other possible workarounds include 
 sandals (aka. flip-flops). These are a good work-around and are widely 
 available for those concerned about their security. 

 Vendor Notification:
 --------------------
  Vendors were not notified at the time of this writing.  We have choosen not to
 give advance notice because the fault is not always with the vendor of the 
 shoe as a REMOTE PERSON could SNAIL MAIL a LOCAL USER a  vulnerable shoe.

 We at 0x90.org believe that the users should be happy they were notified about 
 this.  Imagine the mass destruction and chaos that would ensue if we unleashed 
  a REMOTE SHOE VULNERABILITY WORM into the wild.  At this time we have choosen 
 not to do that, mostly because we can not afford all the stamps to mail 
 vulnerable shoes to the public.

props to the 0x90 guys for identifying, analyzing and releasing this
critical information, if it wasn't for ground breakers such as this
the interwebz may end up being destroyed by such careless systems
engineering.

Dre

On 9/8/05, y0himba <y0himba@...hnolounge.org> wrote:
> Is "Shoe 20" a hardened foot protection?
> 
> -----Original Message-----
> From: Ted Frederick [mailto:tfrederick@...entek.com]
> Sent: Thursday, September 08, 2005 12:55 PM
> To: y0himba; full-disclosure@...ts.grok.org.uk; Dan Mack; Tim Doyle
> Subject: RE: [Full-disclosure] Security Hole Found In Dave's Sock
> 
> Dear list,
> 
> I know that this list is not meant for personal promotion but I think I
> would be remiss if I did not mention that my company has recently released
> an upgrade to our initial offering of Shoe 1.0.  The upgrade to Shoe 2.0
> includes a firewall/anti-virus product previously known as Sock 3.4563.v54.
> 
> The upgrade cost is $19.99. There is also a required software assurance
> subscription of $325.79 monthly.
> 
> If all goes well with the new product I suspect that we will be purchased by
> a major software vendor before year end thus making updates available on the
> first Tuesday of every month to protect against further holes.  These
> updates will have vague names with no indication of what they actually fix
> which should relieve you of sparing any thought to what risks you may have
> been exposed to prior to the patch.
> 
> Yes, we have in fact thought of everything so you don't have to.
> 
> Ted
> 
> 
> 
> 
> 
> -----Original Message-----
> From: full-disclosure-bounces@...ts.grok.org.uk
> [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of y0himba
> Sent: Thursday, September 08, 2005 12:44 PM
> To: full-disclosure@...ts.grok.org.uk
> Subject: RE: [Full-disclosure] Secuirty Hole Found In Dave's Sock
> 
> What version socks are these?  What type?  4?  4a?  5?
> 
> -----Original Message-----
> From: full-disclosure-bounces@...ts.grok.org.uk
> [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Dave Cawley
> Sent: Thursday, September 08, 2005 12:29 PM
> To: Craig, Tobin (OIG); full-disclosure@...ts.grok.org.uk
> Subject: RE: [Full-disclosure] Secuirty Hole Found In Dave's Sock
> 
>         It's hard to get the socks from different pairs to sync up.
> This can cause confusion for people viewing the socks and in turn cause a
> high volume of inquiries to the system administrator.
> But I'll give it the old college try. Thanks for the input!
> 
> ***************************************************************
> Dave D. Cawley           |
> High Speed Internet      |    The number of Unix installations
> Duryea, PA               | has grown to 10, with more expected.
> (570)451-4311 x104       |  - The Unix Programmer's Manual,1972
> dave.cawley@...lphia.com |
> ***************************************************************
>                   URL => http://www.adelphia.net
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Powered by blists - more mailing lists