Date: Fri, 24 Oct 2014 13:31:28 -0700 From: Michal Zalewski <lcamtuf@...edump.cx> To: oss-security <oss-security@...ts.openwall.com>, Tavis Ormandy <taviso@...xchg8b.com> Subject: Re: strings / libbfd crasher [+Tavis] >> I don't understand the user benefit of extracting strings only from >> certain sections of executables, and I almost feel like it's a side >> effect of strings being a part of binutils more than anything else. > > I fully agree. I wasn't aware strings does any kind of executable > parsing and I was very surprised that there is any attack vector at all > against it at all. Tavis mentioned to me some time ago that he made that suggestion upstream when he bumped into other issues many years ago; he can probably comment on how that went, but more generally, distro vendors have some latitude to apply non-upstream patches to change the default behavior... maybe that's the way to go. /mz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.