Le 04/10/2011 16:50, Michael scherer a écrit :
On Tue, Oct 04, 2011 at 11:30:29AM +0200, Buchan Milne wrote:
On Monday, 3 October 2011 15:58:36 Michael Scherer wrote:
Except if I start to replace this by "here is a nice syslinux boot image
with a duck". And then my code is run by syslinux, just because someone
took my png picture.
And the same person could say, "Here is my cool plymouth splash screen, use my
initrd", and there are 1000 easier ways to exploit this (than trying to
generate a PNG image with exploit code that someone would like enough to use
syslinux).
Sure, but we can also upload the pics on some gnome-art or something like that.
Now, if we consider every possible exploit requires opening a document as a non
problem, I guess it would surely reduce our workload on security issue, and
for sure enhance the confidence.
Those situations are not really comparable. Opening a document with the
corresponding application is a normal usage scenario, whereas
configuring the boot process is a system administration scenario,
requiring explicit context change.
And while I was not aware of it when I wrote my mail, it already happened :
MDKSA-2006:210
Nobody said it didn't happened, just than forcing build against system
version of the library would requires more effort right now, without
avoiding the need to also rebuild syslinux in case of vulnerability in
libpng, as it is statically linked. It would just make easier to track
vulnerability by having a single version, and avoid to patch twice.
--
Guillaume
