Home page logo

bugtraq logo Bugtraq mailing list archives

RE: DJB's students release 44 *nix software vulnerability advisories
From: "Devin Ganger" <DevinG () 3sharp com>
Date: Tue, 21 Dec 2004 13:20:09 -0800

Jonathan T Rockway writes:

Regarding local versus remote, look at it this way:  You have 
a 100% secure system.  Then you install NASM.  Now a user 
FROM THE NETWORK can send you some tainted assembly code for 
you to assemble and he can compromise your account.  That is 
why it is considered remote.  Local would mean that I, the 
attacker, need an account on the target machine to compromise 
the target account.  In this nasm case, I do not need an 
account.  That is why the wording "remote" was chosen.

By that logic, *no* exploit can ever be considered local. A truly remote
exploit doesn't rely on manual interaction from a local user on the

Now in regards to full disclosure, I think you should all be 
happy that we bothered to tell you all about these exploits.  
We could have selfishly used them to compromise machines,

When you're trying to argue that your actions were ethical and moral,
pointing out that you could have committed crimes isn't the way to do

but instead we wrote them up and mailed them off to the users and 
the authors!  That is very nice of us.

No, it's the absolute minimum level of ethical behavior one expects from
serious security researchers. Nothing nice about it.

If you would like notification sooner than the "public", find 
the exploit yourself.  If I can find them, then surely anyone can.

One day, when you are writing software for distribution, someone will
find an error in your code. When that day comes, remember this attitude.
While those who discover those bugs and exploits in your software have
no obligation to give you advanced warning of your bugs, I'm certain
you'd be grateful to have that warning so you have time to fix the bug
before word goes public.

Devin L. Ganger             Email: deving () 3sharp com
3Sharp LLC                  Phone: 425.882.1032 x 109
15311 NE 90th Street        Cell: 425.239.2575
Redmond, WA  98052          Fax: 425.702.8455

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]