Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Web sites compromised by IIS attack
From: Valdis.Kletnieks () vt edu
Date: Fri, 02 Jul 2004 15:36:15 -0400

On Thu, 01 Jul 2004 19:57:48 PDT, Denis Dimick said:

I do find it "funny" that sendmail and BIND have been thrown out in the 
e-mails (don't think it was you) But these two applications are some of 
the most buggy bits of code ever written.

Yes, they've had bugs.  The point is that they are *not* the buggiest
bits of code ever written.  Remember that we're talking about programs
that provide a complicated service to network clients, and thus prone to
all sorts of odd race condition bugs that might crop up on some system
or other.  And then there's the fact that a lot of bugs get found in those
packages just because a lot of people *look* at that code.

Surf over to sourceforge, grab 8 or 10 projects at random, and
start auditing and bug counting.  Or think about all the postings
we've seen that say "I looked at it for 15 minutes, found 3 exploitable
format string bugs and 5 buffer overruns, got bored and gave up".

If you think Sendmail and Bind are the buggiest, you've obviously not
been around long enough to see some of the *truly* ugly and just plain
screwed up code out there.  I suspect that a ton of bugs lurk in
procmail, only concealed by the fact that anybody who reads the source code
out loud has to make a saving throw or accidentally summon He Who
Must Not Be Named, or some other creeping-horror C'thulhu creature...

Or look at the Javascript and VB and PHP code out there sometime, and
ask what would happen if the authors of THOSE tried writing a 90K or
200K line piece of software, armed only with caffeine, delusions about
their ability, and a 'Learn Foo in 21 Days" book...

Attachment: _bin

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]