I've never seen a buffer overflow vulnerability with straight HTML, all of them utilize an object of some sort be it a faulty HTML>RTF conversion library or imagine object. The difference is browsers are made to support thousands of different objects, languages, formats and media types - EDI processes are not. Where are you going to place your compiled virus code? In all those binary images you swap back and forth with your trading partners?
From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of Jesse Sightler Sent: Tuesday, July 15, 2008 10:01 AM To: [email protected] Subject: Re: [EDI-L] Re: Has anyone seen a virus in an EDI file? While I agree with the basic premise that virus scanning against EDI files is currently worthless, I think that your logic is flawed. Several web exploits have used HTML (pure html, no Javascript) to exploit buffer overflows in browsers to coerce them into executing arbitrary code. An edi translator with a buffer overflow exploit is theoretically exploitable to run executable code. On 7/15/08, Steve Moses <[EMAIL PROTECTED] <mailto:moses%40iomega.com> > wrote: > > I agree. > The possibility of executable binary source code being completely lower > ASCII readable text (especially that actually made sense) is astronomical > > Steve Moses > Systems Analyst > Iomega Corporation > (303) 681-2593 > [EMAIL PROTECTED] <mailto:moses%40iomega.com> <moses%40iomega.com><mailto:[EMAIL PROTECTED] <mailto:moses%40iomega.com> <moses%40iomega.com> > > > > ________________________________ > From: [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com> [mailto: > [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com>] On Behalf Of Holt, Jake > Sent: Tuesday, July 15, 2008 8:27 AM > To: [email protected] <mailto:EDI-L%40yahoogroups.com> <EDI-L%40yahoogroups.com> > Subject: RE: [EDI-L] Re: Has anyone seen a virus in an EDI file? > > You could take the 10 worst viruses out there right now, paste their > source code into notepad, save it and email it to all your friends > without a single one getting a virus. > > Compiled code cannot exist inside plain, human readable text. Tell your > infosec folks to focus on finding a solution for "Acts of God, Natural > Disasters, War, Terrorism... and the other fun ones" because at least > those risks exist. > > Jake Holt > > Samsill Corporation > > EDI / .Net External Application Development > > (817) 536-1906 ext 217 > > [EMAIL PROTECTED] <mailto:jholt%40samsill.com> <jholt%40samsill.com><mailto:jholt%40samsill.com<jholt%2540samsill.com> > > > > [Non-text portions of this message have been removed] > > [Non-text portions of this message have been removed] > > > [Non-text portions of this message have been removed] [Non-text portions of this message have been removed] ------------------------------------ ... Please use the following Message Identifiers as your subject prefix: <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> Job postings are welcome, but for job postings or requests for work: <JOBS> IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/EDI-L/ <*> Your email settings: Individual Email | Traditional <*> To change settings online go to: http://groups.yahoo.com/group/EDI-L/join (Yahoo! ID required) <*> To change settings via email: mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
