Messages in this thread | | | From | (H. Peter Anvin) | Subject | Re: Linux Buffer Overflow Security Exploits | Date | 18 Mar 1999 09:31:08 GMT |
| |
Followup to: <199903180715.IAA00425@cave.BitWizard.nl> By author: R.E.Wolff@BitWizard.nl (Rogier Wolff) In newsgroup: linux.dev.kernel > > Matthias Urlichs wrote: > > R.E.Wolff@BitWizard.nl (Rogier Wolff) writes: > > > is a bit more comfortable than writing a program that continually > > > tries to pass illegal arguments to system calls, because when you > > > succeeed, you will crash your machine many times before you have > > > an "exploit". > > > > > Umm, if you crash your machine by passing illegal values to syscalls then > > you _have_ found an exploit. > > Agreed. I meant "an exploit that gives you full control over the machine". > > Just crashing a machine is nice for denial of service, but if you want > to steal company secrets full control over a machine is much more useful. >
Well, it's still a serious bug that should be fixed, pronto. I presume your intent is to find bugs, not find a "useful" exploit.
-hpa -- "The user's computer downloads the ActiveX code and simulates a 'Blue Screen' crash, a generally benign event most users are familiar with and that would not necessarily arouse suspicions." -- Security exploit description on http://www.zks.net/p3/how.aspb
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |