When is it valid to claim that a vulnerability leads to a remote attack?

[Jonathan Leffler <jleffler () us ibm com>]

A reputable security defect reporting organization is claiming that a
Windows program is subject to a remote attack because:

* The vulnerable program (call it 'pqrminder') is registered as the
'handler' for files with a specific extension (call it '.pqr').
* If the user downloads a '.pqr' file (or is sent on in the mail and clicks
on it), then 'pqrminder' is invoked.
* If the file is malformed, then arbitrary code can be executed (buffer
overflow).

While recognizing that there is a bug here, that does not strike me as
being what is normally meant by a 'remote attack'.

--
Jonathan Leffler (jleffler () us ibm com)
STSM, Informix Database Engineering, IBM Information Management
4400 N First St, San Jose, CA 95134-1257
Tel: +1 408-956-2436         Tieline: 475-2436
"I don't suffer from insanity; I enjoy every minute of it!"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/