Re: On classifying attacks

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 14, 2005, at 9:39 PM, Derek Martin wrote:

> This kind of attack has a name already: it is a trojan horse.
<snip>
> But is this a remote exploit?

No, it's not an exploit at all.  Systems are not vulnerable to it  
unless a local user runs an executable.  The only thing it exploits  
is trust of email (or similar vector).

Your example involving BIND is a good example of a true remote  
exploit.  A local exploit is typically categorized as one that  
requires permissions on the system to begin with, and is used to gain  
elevated permissions (such as exploiting a setuid program, or causing  
root to write files through symlink race conditions).

This leaves one significant class of vulnerabilities, however.  Let's  
imagine for a moment that there is a buffer overflow in libjpeg that  
allows an attacker to create a malicious JPEG which can cause any  
program using libjpeg to execute arbitrary code.  This should be  
classified as a remote vulnerability.  Users should be able to trust  
that opening a JPEG file will only cause certain code to run, namely  
decoding and displaying that JPEG. 
 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFC2El6TYcj5d9bqjoRAsMcAKCKXn5l/B7WH4B49JIidvCXz3utRgCgxIBo
xXQ3xMVvvTAZZtz7jXXd12o=
=EhoG
-----END PGP SIGNATURE-----