Re[2]: Microsoft FTP Client Multiple Bufferoverflow Vulnerability

[3APA3A]

Dear [EMAIL PROTECTED],



--Friday, November 30, 2007, 1:19:49 AM, you wrote to [EMAIL PROTECTED]:


>> An attacker who can convince an user to extract a specially crafted
>> archive can overwrite arbitrary files with the permissions of the user
>> running gtar.  If that user is root, the attacker can overwrite any
>> file on the system.

VKve> Apparently, somebody at FreeBSD thinks "can be exploited if you trick the
VKve> user into doing something" is a valid attack vector.

This  is  valid  factor.  The  difference  is,  if you can force user to
extract  archive, you need vulnerability in gtar in order to exploit. If
you  can  force user to run executable script, you need no vulnerability
in FTP client to exploit this.


-- 
~/ZARAZA http://securityvulns.com/
Неприятности начнутся в восемь.  (Твен)

Re[2]: Microsoft FTP Client Multiple Bufferoverflow Vulnerability

[Matthew Leeds]

Given the past issues with .zip and .rar unpackers, unpacking an archive should 
be considered a risky activity. In some sense, opening, accessing, playing, or 
otherwise touching any file from an unknown source could be considered risky. 
The list of issues with media files, archive files, (or more accurately put, 
the applications that handle them) and the like is too long to recite, but 
informative.

--
---Matthew
*** REPLY SEPARATOR  ***

On 11/29/2007 at 6:09 PM Steve Shockley wrote:

>[EMAIL PROTECTED] wrote:
>>> An attacker who can convince an user to extract a specially crafted
>>> archive can overwrite arbitrary files with the permissions of the user
>>> running gtar.  If that user is root, the attacker can overwrite any
>>> file on the system.
>>
>> Apparently, somebody at FreeBSD thinks "can be exploited if you trick the
>> user into doing something" is a valid attack vector.
>
>The difference is that I'd be surprised when I got 0wned by unpacking an
>archive, and not all that surprised when I got 0wned by running a random
>executable (script) file.