[Am-info] Re: So many holes, so little time

[Glenn T. Livezey, Ph.D.]

>From: "Fred A. Miller" <fm@cupserv.org>
>Subject: [Am-info] CERT Advisory CA-2001-31 Buffer Overflow in CDE 
>Subprocess Control Service
>There  is  a  remotely  exploitable buffer overflow vulnerability in a
>library  function  used  by  the  CDE Subprocess Control Service. This
>vulnerability  could  be  used  to  crash  the  service  or to execute
>arbitrary  code with root privileges. This vulnerability is documented
>in VU#172583.

Looks like at least one case here where a machine was infiltrated and
a DVD copy of "Full Metal Jacket" was installed and posted to the web,
all without the knowledge of the operator of that box. Pretty slick
insertion, locked out anybody who might come after, created directories
to blend into the tree structure with names like "..."
Yes, M$ shells aren't the only vulnerable 'OS's. But this attack took
brains, effort and individual attention to obtain one victory. With M$,
its more like leading one weakest-link lemming to the cliffs edge, and 
then sitting back to watch 'the fun' as generations leap to their death.
No real comparison there. I also think the notion that network attacks
are the next wave, and will be far worse, is true. However, in most 
cases, the problem and the solution will/should be focused on dumb, 
brute force volume attacks (eg DOS) by exploits of M$ SwissCode 
(so many holes, so little time). That is, if the Bush administration
doesn't make it illegal to mention, let alone criticize, M$ code flaws.
After all, it isn't patriotic to criticize a profitable enterprise, or
blind consumption of inferior products. So, in the interests of 
"national/economic security", the internet shall remain unsecure and
the public shall remain insecure - to secure a completely "free" and
exploitable market.

Glenn
-- 
Glenn T. Livezey, Ph.D.

University of Minnesota
Neuroscience Department
Room 6-145 Jackson Hall
321 Church St. S.E.
Minneapolis, MN 55455

(612) 624-2991 FAX 6-5009 
glivezey@lenti.med.umn.edu
livezey@bigfoot.com