On Thu, 27 Mar 2003 Scott Raney <[EMAIL PROTECTED]> wrote: > The primary vulnerabilities are in the third-party libraries we use. > For example, I wouldn't be surprised if you could force the engine > to crash or execute arbitrary machine code by passing it a carefully > crafted bogus GIF/JPEG/PNG image, QT movie, or compress() stream.
A quick followup to my post. This came over the SANS mailing list today (see http://www.sans.org/ to get on that list): ----------------------------------------------------------------------- *** {03.13.018} Win - QuickTime player URL overflow Apple's QuickTime player versions prior to version 6.1 have a remotely exploitable buffer overflow in the handling of quicktime:// URLs. It allows a malicious Web site to execute arbitrary code on the user's system. ----------------------------------------------------------------------- That digest included a report of yet another buffer overflow bug in sendmail, the second one in two weeks. Given the scarcity of "crash the program" bug reports we've had against the MetaCard 2.5 betas, I still stand by my claim that if you take even minimal care in your scripting it's a lot less likely that someone will be able to use your MetaCard/Revolution application to break into a system than if they're running even the most widely used (and tested) applications written in third generation languages. Regards, Scott ******************************************************** Scott Raney [EMAIL PROTECTED] http://www.metacard.com MetaCard: You know, there's an easier way to do that... _______________________________________________ use-revolution mailing list [EMAIL PROTECTED] http://lists.runrev.com/mailman/listinfo/use-revolution
