Bugtraq: Re: [Full-Disclosure] Misinformation in Security Advisories (ASN.1)

[Valdis.Kletnieks () vt edu]

On Mon, 16 Feb 2004 08:42:23 PST, John Compton <john_compton24 () yahoo com>  said:

> You are likely not going to see any more than the DoS exploit that has
> already come out. For those of you interested in the technical explanation of
> why, it is included below (it's honestly beyond my complete understanding).
> Most of the security researchers I've spoken to agree with this assessment and
> the information below.
Now which should I believe here:

1) Your proof of why it's not possibly exploitable when you yourself admit you don't
understand it?

2) The possibility that some clever black hat fully understands the challenges
and has found a way around it? (Say, wasn't there another exploit a while ago
that managed to work around that "exception handlers don't use the heap"
problem?)

Attachment: _bin
Description: