[VIM] macromedia annoying wording/reference

[Matthew Murphy]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

security curmudgeon wrote:
> 
> http://www.macromedia.com/devnet/security/security_zone/mpsb05-13.html
[...]
> iDefense  JWS Denial of Service Vulnerability

It appears that the error is on the part of Adobe.  iDEFENSE's JRun 4
advisory
(http://www.idefense.com/intelligence/vulnerabilities/display.php?id=360)
links to that specific advisory.  They are talking about the same issue,
it appears.

Indeed, the terminology is annoying, but it appears Adobe extrapolated
iDefense's analysis:

"Although this vulnerability allows a stack overwrite, it may be more
difficult to exploit due the input string being converted into a 'wide
character' version of the str input, by placing a null byte between
each character. While this does not necessarily prevent exploitation, it
does increase the complexity of developing an exploit.

Exploitation of this vulnerability may allow a remote attacker to
execute code on the affected system as Local System, allowing complete
compromise, or cause a denial of service against the affected system,
preventing legitimate use."

to mean that the issue was not practically exploitable.  This is
more-than-likely wrong, as Unicode overflows have been extensively
researched and found to be exploitable in most cases where ANSI
overflows are.

The terminology certainly is annoying.  More frustrating is the obvious
downplay being done by Adobe.  But, given Adobe's history of suing
researchers (or having them arrested) for cracking its lousy DRM on PDFs
and eBooks, no surprise there on my part.

- --
"Social Darwinism: Try to make something idiot-proof,
nature will provide you with a better idiot."

                                -- Michael Holstein

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDsKuAfp4vUrVETTgRAzH0AKCOdisg/424Na4crTWerXiD+VMnFACdFg9h
+FTy8r2IhudZ3u5EdeQsbHg=
=jz4h
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3436 bytes
Desc: S/MIME Cryptographic Signature
Url : http://www.attrition.org/pipermail/vim/attachments/20051226/ecf6e3b2/attachment.bin