So, I read this, and I think, "it is surprising that Zed Shaw doesn't know what a buffer overflow is". For instance, his "extensions" "overflow" is a case where 2-3 character strings are "overflowing" a MAXPATHLEN buffer.
Favorite quote: "Seems like there’s some changes here to determine correct stack direction on the native CPU. Why, that could be a stack smash exploit in the making!" You go, Zed.
Two tips:
1. It's Ruby. Go write the exploit. If you think it's the patch to bignum (where the offset you're looking at only controls a load, not a store), write the testcase and prove it.
1. It's Ruby. Go write the exploit. If you think it's the patch to bignum (where the offset you're looking at only controls a load, not a store), write the testcase and prove it.
Why should he? He doesn't care, he doesn't use Ruby anymore. You can rest assured that someone else has already written the exploit, but is keeping it to himself. So you can either fix the bug, or hope that the person with the exploit doesn't use it on you.
Also, you should write correct code regardless of whether or not you think it's exploitable. Right!?
It's true. He doesn't claim to know anything about the code. He is just trying to expose the "secret fixes". His thesis (for all of his blog posts) is that the Ruby community sucks. He did all this digging in the name of "proving" that, not to help make Ruby better, nor to prove that he knows anything about security.
Read the last line -- "I guess we’ll find out after the Ruby guys passively aggressively kill me for looking at their open source and …. telling people things."
Comments
So, I read this, and I think, "it is surprising that Zed Shaw doesn't know what a buffer overflow is". For instance, his "extensions" "overflow" is a case where 2-3 character strings are "overflowing" a MAXPATHLEN buffer.
Favorite quote: "Seems like there’s some changes here to determine correct stack direction on the native CPU. Why, that could be a stack smash exploit in the making!" You go, Zed.
Two tips:
1. It's Ruby. Go write the exploit. If you think it's the patch to bignum (where the offset you're looking at only controls a load, not a store), write the testcase and prove it.
2. Read the code, not the diffs.
Good point.
I can't believe I read his whole rant and there wasn't even a simple exploit test case in Ruby.
1. It's Ruby. Go write the exploit. If you think it's the patch to bignum (where the offset you're looking at only controls a load, not a store), write the testcase and prove it.
Why should he? He doesn't care, he doesn't use Ruby anymore. You can rest assured that someone else has already written the exploit, but is keeping it to himself. So you can either fix the bug, or hope that the person with the exploit doesn't use it on you.
Also, you should write correct code regardless of whether or not you think it's exploitable. Right!?
My point was that Zed doesn't seem to know what he's talking about. I'm not sure you just said anything at all.
It's true. He doesn't claim to know anything about the code. He is just trying to expose the "secret fixes". His thesis (for all of his blog posts) is that the Ruby community sucks. He did all this digging in the name of "proving" that, not to help make Ruby better, nor to prove that he knows anything about security.
Read the last line -- "I guess we’ll find out after the Ruby guys passively aggressively kill me for looking at their open source and …. telling people things."