Re: [Full-disclosure] Security Bug in MSVC



On Tue, 17 Jan 2006, Morning Wood wrote:

> extract, and open hello.dsw
> click "batch build, build" or "rebuild all"
> code will execute ( calc.exe and notepad.exe used as an example )

What's the point of building a bunch of sources unless
1. you trust their author, or
2. you have made sure their is nothing malicious there?

When you build an executable from untrusted sources, you get an untrusted
executable. Either you run it and you're screwed anyway, or you don't run
it and you wasted your time building it.

(Indeed, there are some marginal cases like when you want to build an
executable file intended to run on someone else's computer...)

--Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: anti-virus software for Gnu/Linux
    ... > I have read several opinions regarding AV for Gnu/Linux. ... never ever execute anything from untrusted sources (and email is ... On unix/linux machines you can risk and execute it as ...
    (Debian-User)
  • Re: [Full-disclosure] Security Bug in MSVC
    ... "rebuild all" code will execute ... When you build an executable from untrusted sources, ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: Old Paper--The Stability Problem in Feedback Amplifiers
    ... If you have a version of WINRAR that will run on a MAC, you can extract the ... And Windows users who have WINRAR can extract the .pdf file without using ... they need not execute the .exe. ...
    (rec.audio.tubes)
  • Re: How to install Unreal Tournament 2004 server for linux.
    ... > instructs to extract to a folder and for linux, to execute the program ... The permission had no execution checked so ...
    (Fedora)
  • Re: XP Sevice Pack 2 wizard will not launch
    ... Try execute the package name with "-x" parameter. ... This command will just extract the files. ... MVP Windows Shell/User ... but the xp sp2 wizard fails to launch. ...
    (microsoft.public.windowsupdate)