[39673] in bugtraq
Re: On classifying attacks
daemon@ATHENA.MIT.EDU (James Longstreet)
Sat Jul 16 19:01:23 2005
In-Reply-To: <20050715023930.GE23576@sophic.org>
Mime-Version: 1.0 (Apple Message framework v733)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <DFE4F2E1-38F5-475A-A9E1-B151C1556C84@uic.edu>
Cc: bugtraq@securityfocus.com
Content-Transfer-Encoding: 7bit
From: James Longstreet <jlongs2@uic.edu>
Date: Fri, 15 Jul 2005 18:40:42 -0500
To: Derek Martin <code@pizzashack.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Jul 14, 2005, at 9:39 PM, Derek Martin wrote:
> This kind of attack has a name already: it is a trojan horse.
<snip>
> But is this a remote exploit?
No, it's not an exploit at all. Systems are not vulnerable to it
unless a local user runs an executable. The only thing it exploits
is trust of email (or similar vector).
Your example involving BIND is a good example of a true remote
exploit. A local exploit is typically categorized as one that
requires permissions on the system to begin with, and is used to gain
elevated permissions (such as exploiting a setuid program, or causing
root to write files through symlink race conditions).
This leaves one significant class of vulnerabilities, however. Let's
imagine for a moment that there is a buffer overflow in libjpeg that
allows an attacker to create a malicious JPEG which can cause any
program using libjpeg to execute arbitrary code. This should be
classified as a remote vulnerability. Users should be able to trust
that opening a JPEG file will only cause certain code to run, namely
decoding and displaying that JPEG.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)
iD8DBQFC2El6TYcj5d9bqjoRAsMcAKCKXn5l/B7WH4B49JIidvCXz3utRgCgxIBo
xXQ3xMVvvTAZZtz7jXXd12o=
=EhoG
-----END PGP SIGNATURE-----
