[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <cb5b46fd-8e2c-2638-c23-f557483c6fa@gathman.org>
Date: Tue, 2 Nov 2021 16:52:33 -0400 (EDT)
From: Stuart D Gathman <stuart@...hman.org>
To: oss-security@...ts.openwall.com
Subject: Re: Trojan Source Attacks
On Mon, 1 Nov 2021, Nicholas Boucher wrote:
> The first and primary technique, which we dub the Trojan Source attack, uses
> Unicode Bidirectional (Bidi) control characters embedded in comments and
> string literals to produce visually deceptive source code files. This
> technique enables an adversary to encode constructs that visually appear to
> be comments or string literals but execute as code, or vice versa. Complete
> details, as well as recommended mitigations, can be found in the attachment
> 001 Trojan Source.pdf. This vulnerability is tracked under CVE-2021-42574.
Syntax coloring thus becomes a critical security tool. And bugs in
syntax coloring for an editor/viewer should be consider security flaws
and reported on oss-security.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
