An EDI translator isn't like notepad, as it actually does pull data into various buffers as its loaded. Are those buffers fixed length? What do they do with malformed segments? Is it possible to trick one into crashing (if you've ever seen a translator crash on bad data, you have a clue as to a potential vulnerability)?
The attack vector is limited largely by the complete and utter lack of interest by attackers, and the difficulty in injecting evil packets into a communication stream (remember your training in security tradeoffs?), not by the complete absence of vulnerabilities. And to answer your question, I'd be fascinated to see buffer overflow examples in cobol, but I suspect them to be few and far between. Depending upon the platform it is fairly common to see dep (data execution protection) turned on which makes buffer overflows extremely difficult to exploit (as/400s, and slowly Linux/Win as well). On 7/15/08, Brian Lehrhoff <[EMAIL PROTECTED]> wrote: > > Gentran Unix Server is a compiled COBOL application that doesn't > run IE. Is it still vulnerable? > Brian Lehrhoff, EA ([EMAIL PROTECTED]) > Messaging Consultant 201-913-4506 > Upgrade your Quickbooks for 20% off at http://ea.brianlehrhoff.com > Circular 230 Notice is located at > http://ea.brianlehrhoff.com/230notice.html > > > ----- Original Message ---- > From: Jesse Sightler <[EMAIL PROTECTED]> > To: [email protected] > Sent: Tuesday, July 15, 2008 1:53:30 PM > Subject: Re: [EDI-L] Re: Has anyone seen a virus in an EDI file? > > Here is one example from about 30 seconds of googling: > > http://secunia.com/advisories/12959/ > > Of course, with EDI, the only practical defense is to trade only with > trading partners that you trust, and use secure communication protocols. > > (ie, I agree with those who argue that protecting against this specific > threat is ridiculous, when there are many more likely channels that you > should be directing your energy towards defending) > > > On 7/15/08, Holt, Jake <[EMAIL PROTECTED]> wrote: > > > > I've never seen a buffer overflow vulnerability with straight HTML, all > > of them utilize an object of some sort be it a faulty HTML>RTF > > conversion library or imagine object. The difference is browsers are > > made to support thousands of different objects, languages, formats and > > media types - EDI processes are not. Where are you going to place your > > compiled virus code? In all those binary images you swap back and forth > > with your trading partners? > > > > From: [email protected] <EDI-L%40yahoogroups.com> [mailto: > > [email protected] <EDI-L%40yahoogroups.com>] On Behalf Of > > Jesse Sightler > > Sent: Tuesday, July 15, 2008 10:01 AM > > To: [email protected] <EDI-L%40yahoogroups.com> > > Subject: Re: [EDI-L] Re: Has anyone seen a virus in an EDI file? > > > > While I agree with the basic premise that virus scanning against EDI > > files > > is currently worthless, I think that your logic is flawed. Several web > > exploits have used HTML (pure html, no Javascript) to exploit buffer > > overflows in browsers to coerce them into executing arbitrary code. An > > edi > > translator with a buffer overflow exploit is theoretically exploitable > > to > > run executable code. > > > > On 7/15/08, Steve Moses <[EMAIL PROTECTED] <moses%40iomega.com> <mailto: > > moses%40iomega.com <moses%2540iomega.com>> > > > wrote: > > > > > > I agree. > > > The possibility of executable binary source code being completely > > lower > > > ASCII readable text (especially that actually made sense) is > > astronomical > > > > > > Steve Moses > > > Systems Analyst > > > Iomega Corporation > > > (303) 681-2593 > > > [EMAIL PROTECTED] <moses%40iomega.com> > <mailto:moses%40iomega.com<moses%2540iomega.com> > > > > > <moses%40iomega.com><mailto:[EMAIL PROTECTED] > <moses%40iomega.com> <mailto: > > moses%40iomega.com <moses%2540iomega.com>> > > <moses%40iomega.com> > > > > > > > > > > ________________________________ > > > From: [email protected] <EDI-L%40yahoogroups.com> <mailto: > > EDI-L%40yahoogroups.com <EDI-L%2540yahoogroups.com>> > > <EDI-L%40yahoogroups.com> [mailto: > > > [email protected] <EDI-L%40yahoogroups.com> <mailto: > > EDI-L%40yahoogroups.com <EDI-L%2540yahoogroups.com>> > > <EDI-L%40yahoogroups.com>] On Behalf Of Holt, Jake > > > Sent: Tuesday, July 15, 2008 8:27 AM > > > To: [email protected] <EDI-L%40yahoogroups.com> <mailto: > > EDI-L%40yahoogroups.com <EDI-L%2540yahoogroups.com>> > > <EDI-L%40yahoogroups.com> > > > Subject: RE: [EDI-L] Re: Has anyone seen a virus in an EDI file? > > > > > > You could take the 10 worst viruses out there right now, paste their > > > source code into notepad, save it and email it to all your friends > > > without a single one getting a virus. > > > > > > Compiled code cannot exist inside plain, human readable text. Tell > > your > > > infosec folks to focus on finding a solution for "Acts of God, Natural > > > Disasters, War, Terrorism... and the other fun ones" because at least > > > those risks exist. > > > > > > Jake Holt > > > > > > Samsill Corporation > > > > > > EDI / .Net External Application Development > > > > > > (817) 536-1906 ext 217 > > > > > > [EMAIL PROTECTED] <jholt%40samsill.com> > <mailto:jholt%40samsill.com<jholt%2540samsill.com> > > > > > <jholt%40samsill.com><mailto:jholt%40samsill.com > <jholt%2540samsill.com> > > <jholt%2540samsill.com> > > > > > > > > > > [Non-text portions of this message have been removed] > > > > > > [Non-text portions of this message have been removed] > > > > > > > > > > > > > [Non-text portions of this message have been removed] > > > > [Non-text portions of this message have been removed] > > > > > > > > > [Non-text portions of this message have been removed] > > > ------------------------------------ > > ... > Please use the following Message Identifiers as your subject prefix: > <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> > > Job postings are welcome, but for job postings or requests for work: <JOBS> > IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links > > > > > ------------------------------------ ... Please use the following Message Identifiers as your subject prefix: <SALES>, <JOBS>, <LIST>, <TECH>, <MISC>, <EVENT>, <OFF-TOPIC> Job postings are welcome, but for job postings or requests for work: <JOBS> IS REQUIRED in the subject line as a prefix.Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/EDI-L/ <*> Your email settings: Individual Email | Traditional <*> To change settings online go to: http://groups.yahoo.com/group/EDI-L/join (Yahoo! ID required) <*> To change settings via email: mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
