Re: Spam Update/Cyber Promo attacked

At 08:35 PM 5/7/97 -0700, Bill Frantz wrote:
>Now, if we could only go back 30 years and give C a reasonable string
>model, we might be able to eliminate 50% of the known holes in Unix
>security.

Though shalt not use static size buffers for variable length data. [I don't
need to tell this to Bill and many others on this list. The rest better
chisel it in granite. :-]



-- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred

   "I do believe that where there is a choice only between cowardice and
    violence, I would advise violence." Mahatma Gandhi

On Wed, 7 May 1997, Lucky Green wrote:

> Though shalt not use static size buffers for variable length data. [I don't
> need to tell this to Bill and many others on this list. The rest better
> chisel it in granite. :-]

Exception1: Unless you are fragmenting incoming data into chunks equal to 
or smaller than the size of your static buffer less 1 byte for the NUL 
character terminator. :)

Lemma1: Never assume anything about incoming data sizes, or formats.  
Example: The SBM client being able to do the equivalent of "cd .." on the 
root level of an NT share.

Lemma2: Always make sure when expecting data to time out if you do not 
receive what you expect.  Example: telnet to port 135 of unpatched NT 
server 4.0, type 10 characters, hit ENTER and disconnect.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.|  Ray Arachelian    | "So make a move and plead the fifth,   |./|\.
..\|/..|sunder@sundernet.com|  'cause you can't pleade the first!"   |/\|/\
<--*-->| ------------------ |                                        |\/|\/
../|\..| "A toast to Odin,  | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die.     |.....
======================== http://www.sundernet.com =========================