Re: [Full-disclosure] Cisco IOS Shellcode Presentation

On Fri, 29 Jul 2005, Frank Knobbe wrote:

> On Fri, 2005-07-29 at 18:57 -0500, J.A. Terranson wrote:
> > They fucked up.  They'll have to fix it then.  But thats not the same
> as
> > the gross negligence they're being accused of.
>
> I'm not sure that can fix that. Unless they add canaries to the stack
> and include other OpenBSD style W^X type checks.

Those are one option (one I don't like BTW).  Actually, I was alluding to
the Harvard Architecture.  But however they choose to do it, they'll
either have to fix it or suffer the financial consequences.  What they
*can't* do is put the genie back into the bottle - that particular genie
is getting gray hairs now!

Also, that Cisco must fix was not the point of my argument.  I was trying
to point out that Jaosn's basic premise that this was a grossly negligent
act by Cisco is pure fiction.

-- 
Yours,

J.A. Terranson
sysadmin@mfn.org
0xBD4A95BF


"A stock broker is someone who handles your money until its all gone."
Diana Hubbard (of Scientology fame)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/