[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201103141406.47580.stephan.mueller@atsec.com>
Date: Mon, 14 Mar 2011 14:06:46 +0100
From: Stephan Mueller <stephan.mueller@...ec.com>
To: Dan Rosenberg <dan.j.rosenberg@...il.com>
Cc: oss-security@...ts.openwall.com,
Vasiliy Kulikov <segoon@...nwall.com>
Subject: Re: Untrusted fs and invalid filenames
Am Montag, 14. März 2011, um 13:56:45 schrieb Dan Rosenberg:
Hi Dan,
>
> I'd like to add that while this kind of hardening would be nice in
> theory, there is little urgency in making these improvements since the
> proposed attack vectors are extremely limited. As I see it, there are
> four scenarios where this might matter:
I am not so sure that all the following is unlikely:
>
> 1. An attacker convinces a victim to download an evil filesystem image
> and manually mount it.
I guess that is the most likely vector - how often did you download ISO images
from somewhere - it is often for me?
How often did you get USB drives from somebody - it happens frequently?
How often did you mount them?
I guess, this happened often. The concern here is that most users are very
unsuspecting of the discussed issue. Most people think that you should not
execute files from unknown media. But hardly anyone thinks that simply
mounting the media or listing directory contents would cause problems. At
least that is what I have learned.
Ciao
Stephan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
