cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1995-09-22 - Re: Another Netscape Bug (and possible security hole)

Header Data

From: Ray Cromwell <rjc@clark.net>
To: perry@piermont.com
Message Hash: 5855d81b2011edc86e0c20721abb6a93e86d39b6ce517276e3c55fa0fb985595
Message ID: <199509221713.NAA11980@clark.net>
Reply To: <199509221236.IAA03762@frankenstein.piermont.com>
UTC Datetime: 1995-09-22 17:14:04 UTC
Raw Date: Fri, 22 Sep 95 10:14:04 PDT

Raw message

From: Ray Cromwell <rjc@clark.net>
Date: Fri, 22 Sep 95 10:14:04 PDT
To: perry@piermont.com
Subject: Re: Another Netscape Bug (and possible security hole)
In-Reply-To: <199509221236.IAA03762@frankenstein.piermont.com>
Message-ID: <199509221713.NAA11980@clark.net>
MIME-Version: 1.0
Content-Type: text/plain


Perry writes:
> > These buffer overflow bugs should be taught in every programming
> > 101 course along with fencepost errors.
> > 
> > I'm not even sure if I want to write the obligatory program to exploit
> > the hack given that some malicious jerk would probably use it
> > on his home page to attack people.
> 
> The problem is that if you don't produce a (benign) exploit people
> aren't going to take it seriously enough.

  Yeah, I guessed that. I'll work on it, I have a few doubts I have
to research first. For instance, how to embed code in the domain that
1) server/client processing won't "cook" and 2) contains no isolated
zero bytes which would null terminate the string.

  My current idea is to look in Netscape for an "exec" routine,
and call it passing a "/bin/csh" to it.

  Irregardless, it's a nasty bug given that you can crash anyone's
netscape. And on Mac/Win3.1, it may even require a reboot.

-Ray

Thread