all things security

shoeLace.txt

shoeLace.txt
Posted Dec 31, 2004

Very amusing spoof advisory regarding Shoe 1.0 - Remote Lace overflow.

tags | remote, overflow, spoof
systems | unix
MD5 | 29c7913abd04d38b657b6be68561c066

shoeLace.txt

Change Mirror Download
 Shoe 1.0 - Remote Lace Overflow
--------------------------------------------

This Vulnerability is in reference to the new class of remote vulnerabilities
indicated in:
http://www.securityfocus.com/archive/1/385078/2004-12-19/2004-12-25/2
[Please read that first]

Discovery Credited To:
----------------------
freshman - 0x90.org
wxs - 0x90.org
txs - 0x90.org

Greets:
-------
Jonathan T. Rockway for being the smartest man alive.

Description:
------------
A remote shoe vulnerability exists that could allow for remote tripping and
possible exposure of sensitive data to the pavement.

Scope:
------
REMOTE

Severity:
---------
Hyper-Critical. This needs no explanation.

Vulnerability:
--------------
Failure to properly tie your shoe could result in tripping and a possible
broken face upon sudden deceleration when hitting the pavement.

Vulnerable Sizes:
-----------------
6 through 13. Other sizes may be vulnerable, but were unavailable for testing.

Exploitation:
-------------
You have a 100% secure walking system - you do not fall down, or trip over
your own laces. A remote attacker could determine your shoe size by reading
your livejournal FROM THE NETWORK and could MAIL YOU a shoe with extra long
laces. You put the shoe on without tying it properly and suddenly are exposed
to a REMOTE shoe vulnerability!

Fix:
----
Do not wear untrusted shoes sent to you. Other possible workarounds include
sandals (aka. flip-flops). These are a good work-around and are widely
available for those concerned about their security.

Vendor Notification:
--------------------
Vendors were not notified at the time of this writing. We have choosen not to
give advance notice because the fault is not always with the vendor of the
shoe as a REMOTE PERSON could SNAIL MAIL a LOCAL USER a vulnerable shoe.

We at 0x90.org believe that the users should be happy they were notified about
this. Imagine the mass destruction and chaos that would ensue if we unleashed
a REMOTE SHOE VULNERABILITY WORM into the wild. At this time we have choosen
not to do that, mostly because we can not afford all the stamps to mail
vulnerable shoes to the public.


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    15 Files
  • 19
    Oct 19th
    10 Files
  • 20
    Oct 20th
    7 Files
  • 21
    Oct 21st
    4 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close