Re: [Full-disclosure] Cisco IOS Shellcode Presentation

From: J.A. Terranson (measl_at_mfn.org)
Date: 07/30/05

  • Next message: J.A. Terranson: "Re: [Full-disclosure] Cisco IOS Shellcode Presentation" 
    Date: Fri, 29 Jul 2005 19:23:49 -0500 (CDT)
To: Frank Knobbe <frank@knobbe.us>

    On Fri, 29 Jul 2005, Frank Knobbe wrote:

    > On Fri, 2005-07-29 at 18:57 -0500, J.A. Terranson wrote:
    > > They fucked up. They'll have to fix it then. But thats not the same
    > as
    > > the gross negligence they're being accused of.
    >
    > I'm not sure that can fix that. Unless they add canaries to the stack
    > and include other OpenBSD style W^X type checks.

    Those are one option (one I don't like BTW). Actually, I was alluding to
    the Harvard Architecture. But however they choose to do it, they'll
    either have to fix it or suffer the financial consequences. What they
    *can't* do is put the genie back into the bottle - that particular genie
    is getting gray hairs now!

    Also, that Cisco must fix was not the point of my argument. I was trying
    to point out that Jaosn's basic premise that this was a grossly negligent
    act by Cisco is pure fiction. 

    -- 
Yours,
J.A. Terranson
sysadmin@mfn.org
0xBD4A95BF
"A stock broker is someone who handles your money until its all gone."
Diana Hubbard (of Scientology fame)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
  • Next message: J.A. Terranson: "Re: [Full-disclosure] Cisco IOS Shellcode Presentation"
    • Quantcast