Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 14 Mar 2011 14:06:46 +0100
From: Stephan Mueller <stephan.mueller@...ec.com>
To: Dan Rosenberg <dan.j.rosenberg@...il.com>
Cc: oss-security@...ts.openwall.com,
 Vasiliy Kulikov <segoon@...nwall.com>
Subject: Re: Untrusted fs and invalid filenames

Am Montag, 14. März 2011, um 13:56:45 schrieb Dan Rosenberg:

Hi Dan,

> 
> I'd like to add that while this kind of hardening would be nice in
> theory, there is little urgency in making these improvements since the
> proposed attack vectors are extremely limited.  As I see it, there are
> four scenarios where this might matter:

I am not so sure that all the following is unlikely:
> 
> 1. An attacker convinces a victim to download an evil filesystem image
> and manually mount it.

I guess that is the most likely vector - how often did you download ISO images 
from somewhere - it is often for me?

How often did you get USB drives from somebody - it happens frequently?

How often did you mount them?

I guess, this happened often. The concern here is that most users are very 
unsuspecting of the discussed issue. Most people think that you should not 
execute files from unknown media. But hardly anyone thinks that simply 
mounting the media or listing directory contents would cause problems. At 
least that is what I have learned.

Ciao
Stephan

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.