[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALx_OUD5qWHCdAa6XCLU+7qquNhb92wa84R5U9t+uVobkD3QDw@mail.gmail.com>
Date: Sun, 16 Nov 2014 12:43:10 -0800
From: Michal Zalewski <lcamtuf@...edump.cx>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: Fuzzing findings (and maybe CVE requests) -
Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less
> However, even if tools like file/ndisasm/gimp/readelf can be used by
> many (w/o strong system isolation boundaries) to analyze untrusted
> inputs (for reverse engineering, malware analysis and similar
> purposes) - I'd simply put a blame on those users
Well, it's always the easy option, but keep in mind that there are
countless tutorials that tell people to use 'file' or 'strings' to
examine sketchy file, or use tools such as objdump to do hobby
forensics.
We can blame the authors of the tutorials - but it goes back to a
fairly fundamental problem: the use cases aren't completely crazy
(nothing *fundamentally* wrong in using 'strings' on a file you don't
trust, right?), and their unsafe design is a fairly counterintuitive
property to laypeople and many experts alike [*].
So, for high-profile tools used in ways that are sort of plausible and
probably common, we may just need to try & make them robust. (But of
course, I'd be pragmatic in drawing the line: the Mayhem fuzzing thing
went completely overboard.)
/mz
[*] Fun fact: I don't think I have ever gotten as much shocked
feedback from the security community as after posting
http://lcamtuf.blogspot.com/2014/10/psa-dont-run-strings-on-untrusted-files.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
