Re: DJB's students release 44 *nix software vulnerability advisories

From: Steven M. Christey (coley_at_mitre.org)
Date: 12/21/04

  • Next message: Wei Li: "Realone2.0 "pnxr3260.dll" Lets Remote Users IE Browser Crash" 
    Date: Tue, 21 Dec 2004 16:25:02 -0500 (EST)
To: bugtraq@securityfocus.com

    >> And this nasm bug is then called a "remotely exploitable
    >> security hole".
    >
    >Obviously it is not. I don't think it is even locally exploitable.

    Many of the DJB-reported issues deal with exploitation of errors in
    parsers or converters for specific file formats. Many files are
    typically "shared," such as images, text documents, data exchange
    formats, and so on. So, there can be vectors in which the attacker
    can send a crafted file across network-based channels - web, email,
    whatever - that then could conceivably be processed by the user,
    either manually or automatically.

    Granted, this is a different scenario than might be encountered in
    what's typically labeled a "remotely exploitable" vulnerability, but I
    haven't seen any emerging terminology that's been able to make this
    reasonable distinction. However, with the growing researcher interest
    in finding vulnerabilities based on irregularities in file formats,
    the need for better terminology is growing.

    In addition to modeling the level of authentication needed, I've been
    thinking that it might also be important to note how much user/victim
    participation is required for activation of the exploit, i.e. whether
    the issue can be automatically exploited by normal user activity
    (e.g. by simply reading an email message) or whether there's some
    social engineering involved. However, I haven't put much thought into
    terminology for this besides:

      - automatic: exploit is automatically activated as a result of
        normal usage of the product

      - complicit: requires some victim participation or inaction

      - opportunistic: can not really control when, or if, the victim
        activates the exploit

    Exploitation of web or email client vulnerabilities that happen as
    soon as someone reads a message might be called "automatic," e.g. if
    there's a buffer overflow when preparing a preview of the message. If
    the user needs to click on a button or two, e.g. to extract something
    whose icon shows as a JPG when in fact it's an executable, that might
    be "complicit." If you insert terminal escape sequences into some log
    file in the hopes that an admin accidentally runs "more" or "grep" on
    that log file from the proper terminal, then that might be
    "opportunistic." Phishing might be regarded as either automatic or
    complicit, depending on whether or not you think web client users
    should check their browser's status bar every time they click on a
    link. Again, though, these are just rough ideas.

    - Steve

  • Next message: Wei Li: "Realone2.0 "pnxr3260.dll" Lets Remote Users IE Browser Crash"

    Relevant Pages

    • RE: php pack() security update
      ... I'm waiting for redhat to release updates for php on as3. ... SECUNIA ADVISORY ID: ... Multiple vulnerabilities have been reported in PHP, ... Successful exploitation requires that PHP runs on a multi-threaded ...
      (RedHat)
    • Re: Administrivia: List Announcement
      ... steps in this process are identifying potential vulnerabilities (through ... and will impact various security properties. ... and attack scenarios/methods of exploitation. ... main(int argc, char *argv) ...
      (Vuln-Dev)
    • Re: [Full-disclosure] defining 0day
      ... unknown vulnerabilities. ... We experience MASSIVE exploitation of users ... Vulnerability disclosure - for researchers. ... if WMF was disclosed today after being actively exploited itw for ...
      (Full-Disclosure)
    • php pack() security update
      ... I'm waiting for redhat to release updates for php on as3. ... SECUNIA ADVISORY ID: ... Multiple vulnerabilities have been reported in PHP, ... Successful exploitation requires that PHP runs on a multi-threaded ...
      (RedHat)
    • Analysis of the Exploitation Processes (.pdf)
      ... "Analysis of the Exploitation Processes" ... several of the common types of vulnerabilities together with their ... counterpart command line exploit sequences. ...
      (Vuln-Dev)