Re: [Full-Disclosure] [USN-45-1] nasm vulnerability

From: Martin Pitt (martin.pitt_at_canonical.com)
Date: 12/23/04

  • Next message: Peter Besenbruch: "Re: [Full-Disclosure] Insecurity in Finnish parlament (computers)" 
    Date: Thu, 23 Dec 2004 07:53:06 +0100
To: full-disclosure@lists.netsys.com

    Hi Todd!

    Todd Towles [2004-12-22 14:26 -0600]:
    > So now, I just need to trick a user into running a malicious source file
    > that I assembed and sent him, this makes it much harder.

    Although I understand the irony in this, I still think that this is an
    important issue. Running unknown programs _is_ a different thing than
    merely compiling/assembling something. For example, Debian's and
    Ubuntu's autobuilders compile and assemble code all the day, but the
    compiled code is not actually ran there.

    The key difference is just that by _running_ a program I expect it to
    do something, whereas when I _assemble_ a source file, I do not expect
    it to have any side effects (no system modification apart from writing
    the output file.

    > > -----Original Message-----
    > > From: full-disclosure-bounces@lists.netsys.com
    > > [mailto:full-disclosure-bounces@lists.netsys.com] On Behalf
    > > Of Martin Pitt
    > > Sent: Wednesday, December 22, 2004 4:53 AM
    > > To: ubuntu-security-announce@lists.ubuntu.com
    > > Cc: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com
    > > Subject: [Full-Disclosure] [USN-45-1] nasm vulnerability
    > >
    > > ===========================================================
    > > Ubuntu Security Notice USN-45-1 December 22, 2004
    > > nasm vulnerability
    > > CAN-2004-1287
    > > ===========================================================
    > > [...]

    Martin 

    -- 
Martin Pitt                       http://www.piware.de
Ubuntu Developer            http://www.ubuntulinux.org
Debian GNU/Linux Developer       http://www.debian.org

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Peter Besenbruch: "Re: [Full-Disclosure] Insecurity in Finnish parlament (computers)"

    Relevant Pages

    • Re: [was Luxasm news]
      ... |> should first save the file when they press the assemble option (and the ... the user loses any unsaved changes in their source file. ... but I never lost a single character in the source. ...
      (alt.lang.asm)
    • ANN: @EASE, the exam assembly system
      ... @EASE is for educators who use LaTeX to construct their exams, quizzes, ... document with the source file as an attachment. ... by clicking on the corresponding checkbox, then assemble the selected ... compiled to obtain the exam document. ...
      (sci.math)
    • ANN: @EASE, the exam assembly system
      ... @EASE is for educators who use LaTeX to construct their exams, quizzes, ... document with the source file as an attachment. ... by clicking on the corresponding checkbox, then assemble the selected ... compiled to obtain the exam document. ...
      (de.comp.text.tex)
    • Re: Monofiles vs Splitting into many files
      ... > has to assemble the 16k or so in the file, but it has to load and read ... Consider the following HLA statement: ... Only a few characters appearing in a source file, ... The problem with that theory is that "stdout.put" is a *macro* ...
      (alt.lang.asm)
    Loading