[33769] in bugtraq
Re: [Full-Disclosure] Misinformation in Security Advisories (ASN.1)
daemon@ATHENA.MIT.EDU (Valdis.Kletnieks@vt.edu)
Tue Feb 17 12:39:14 2004
Message-Id: <200402161815.i1GIF6h3005006@turing-police.cc.vt.edu>
To: John Compton <john_compton24@yahoo.com>
Cc: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
In-Reply-To: Your message of "Mon, 16 Feb 2004 08:42:23 PST."
<20040216164223.52416.qmail@web41306.mail.yahoo.com>
From: Valdis.Kletnieks@vt.edu
Mime-Version: 1.0
Content-Type: multipart/signed; boundary="==_Exmh_2070112410P";
micalg=pgp-sha1; protocol="application/pgp-signature"
Content-Transfer-Encoding: 7bit
Date: Mon, 16 Feb 2004 13:15:06 -0500
--==_Exmh_2070112410P
Content-Type: text/plain; charset=us-ascii
On Mon, 16 Feb 2004 08:42:23 PST, John Compton <john_compton24@yahoo.com> said:
> You are likely not going to see any more than the DoS exploit that has
> already come out. For those of you interested in the technical explanation of
> why, it is included below (it's honestly beyond my complete understanding).
> Most of the security researchers I've spoken to agree with this assessment and
> the information below.
Now which should I believe here:
1) Your proof of why it's not possibly exploitable when you yourself admit you don't
understand it?
2) The possibility that some clever black hat fully understands the challenges
and has found a way around it? (Say, wasn't there another exploit a while ago
that managed to work around that "exception handlers don't use the heap"
problem?)
--==_Exmh_2070112410P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001
iD8DBQFAMQiqcC3lWbTT17ARAn/SAJ9LqMAcKxFfLxLG95VbKpWLO7Q5VACgjnCk
ziTNvbtOCZeRifWZCW2/dVU=
=8+42
-----END PGP SIGNATURE-----
--==_Exmh_2070112410P--
