Re: WTF? How can this work?
Re: WTF? How can this work?
- Subject: Re: WTF? How can this work?
- From: "John C. Randolph" <email@hidden>
- Date: Mon, 20 Aug 2001 21:19:43 -0700
On Monday, August 20, 2001, at 07:36 PM, Brian Hill wrote:
On Monday, August 20, 2001, at 08:21 PM, John C. Randolph wrote:
Perhaps, but the fact is that a vast number of security problems in
todays computers are due to the fact that C doesn't do bounds-checking
of arrays or strings.
I'd phrase that more properly as most internet security problems are
due to the fact that Microsoft doesn't do bounds checking of arrays or
strings...
It's not just Microsoft. All of the classic stack-smashing attacks
against fingerd, sendmail, the BSD TCP stack, etc. have had the same
root cause.
-jcr