full-disclosure - Re: Microsoft Office Excel 2010 memory corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAH8yC8kPMbvGyAp6P_i4nqh4N=kq1FDHPix9ki8G9XKdG_52DA@mail.gmail.com>
Date: Mon, 29 Oct 2012 13:59:12 -0400
From: Jeffrey Walton <noloader@...il.com>
To: Peter Ferrie <peter.ferrie@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Microsoft Office Excel 2010 memory corruption

On Mon, Oct 29, 2012 at 1:35 PM, Peter Ferrie <peter.ferrie@...il.com> wrote:
>> How can i make sure a crash is not exploitable? (( The short answer is
>> simple assume every crash is exploitable and just fix it.))
>
> No, it costs a lot of time and money to fix even one issue.
> We don't want to waste it on something that isn't exploitable.
There are at least four problems with this argument. First, the
argument basically says "defective software is OK." I find that to be
negligent (perhaps grossly negligent), and it sets off red flags for
me.

Second, if a shop did not get the basic coding correct, what
credibility does the shop have when they claim its not security
related and cannot be exploited. Often, the folks claiming something
defective is OK are either too dumb or too ignorant to realize they
are wrong. We saw the same with attacks on MD5 from the a number of
folks, including the CAs.

Third, its often easier to fix problems like this than spend the
man-hours studying it. Architectural defects are a different story
though.

Fourth, the software does not meet basic merchanibility standards.
Would you accept an auto defect where your windshield wipers did not
work on occasion?

If a shop gets it wrong too often, I ban the company's software. For
example, I no longer suffer Adobe's bugs on my network because its not
worth my time to shut down the vectors.

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/