lkml.org 
[lkml]   [1999]   [Mar]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Linux Buffer Overflow Security Exploits
Date
Followup to:  <199903180715.IAA00425@cave.BitWizard.nl>
By author: R.E.Wolff@BitWizard.nl (Rogier Wolff)
In newsgroup: linux.dev.kernel
>
> Matthias Urlichs wrote:
> > R.E.Wolff@BitWizard.nl (Rogier Wolff) writes:
> > > is a bit more comfortable than writing a program that continually
> > > tries to pass illegal arguments to system calls, because when you
> > > succeeed, you will crash your machine many times before you have
> > > an "exploit".
> > >
> > Umm, if you crash your machine by passing illegal values to syscalls then
> > you _have_ found an exploit.
>
> Agreed. I meant "an exploit that gives you full control over the machine".
>
> Just crashing a machine is nice for denial of service, but if you want
> to steal company secrets full control over a machine is much more useful.
>

Well, it's still a serious bug that should be fixed, pronto. I
presume your intent is to find bugs, not find a "useful" exploit.

-hpa
--
"The user's computer downloads the ActiveX code and simulates a 'Blue
Screen' crash, a generally benign event most users are familiar with
and that would not necessarily arouse suspicions."
-- Security exploit description on http://www.zks.net/p3/how.aspb

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:50    [W:0.053 / U:1.796 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site