Image flaw pierces PC security

TalkBack 11 of 50:

Next »

« Previous

• Thread View
• Flat View

Extremely Simple. . .

One word, buffer overflow. Anything whether it is a text file, database, executable, image, protocol request string to a port, etc. needs to be read into whatever program or OS function necessary to work with it.

If you do a really stupid job on the routine that does that necessary little piece of work, you are essentially trying to cram 10 lbs of poop into a 5 lb. bag and when it splits the seams, bad things happen.

It can merely crash the machine. In certain situations, it can be used to insert executable code which then runs on your system just like you clicked on an icon or ran a command on the console (Code Red, Nimda, Blaster were all good examples of this, and they weren't even files, just little bits of code sent to a port, in one case what was just supposed to be a 1 bit flag that the programmer forgot to sanitize and dump anything more than one bit).

Even if it is a problem with Metadata within the file, it still comes down to buffer overflow problems with the parsing routine that reads that metadata. We saw this with a MP3 Tags expoit that happened a while back.

Keep in mind that no matter what the ABM/NBM crowd says, yes they are one and the same (each wants to define black=white) if you read their posts, this stuff is all highly complex, designed by humans that are tired, distracted, or just plain lazy or stupid and stuff happens. All software is flawed, you just get to choose your poison and frustration type. The open source crowd has the excuse of limited funding and perhaps lack of expertise. The closed source crowd has the excuse of well, code reuse (someone else originally created the routine, no one checked), too much funding and not enough care.

Posted by: boomslang_z   Posted on: 08/07/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• IBM Smart Business Time Savings Test IBM If time is money - is your organization in need of a way to save both? ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• Trend Micro Email Encryption Client Free Download Trend Micro Trend Micro Email Encryption Client is a software plug-in for popular ... Download Now