Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
[Full-disclosure] Re: Publishing exploit code - what is it good for
From: Curt Sampson (cjscynic.net)
Date: Fri Jul 01 2005 - 01:07:47 CDT
Interesting, becuase this just hit me the other day.
Wearing my sysadmin hat, I woke up one morning to find that the NetBSD
package converters/xlreader had a vulnerability. Nobody seemed to have
a patch for it, but looking at it, even with my rather limited level of
C coding skill, I reckoned I could fix it. (Standard buffer overflow:
replace sprintf with snprintf kinda thing.) So I did.
Or at least, I think I did. I can't get my hands on a working exploit,
so I don't feel truly comfortable that I did indeed fix the problem. Maybe
to someone more familiar with C it would be proved fixed by inspection,
but I don't feel that comfortable with it myself.
I didn't really used to think that exploits were so useful until this.
Curt Sampson <cjscynic.net> +81 90 7737 2974 http://www.NetBSD.org
Make up enjoying your city life...produced by BIC CAMERA
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/