Earlier quoted context omitted.
They don't need to glue USB ports, because IT is intelligent enough to disable access to them via OS configuration. I never understood the stupidity of some people to glue them instead of using OS policies.
I have never seen a company, large or small, which disabled USB ports. Because convenience is always higher rated than security. Glueing is much easier, can't fail with wrong configurations or roll outs, works if people have too many permissions on Linux and in a myriad of other ways.
Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
51–56 of 56 posts
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#52[1] http://www.adobe.com/content/dam/Adobe/en/devnet/acrobat/pdf... section 3.4.1
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#53Earlier quoted context omitted.
I have never seen a company, large or small, which disabled USB ports. Because convenience is always higher rated than security. Glueing is much easier, can't fail with wrong configurations or roll outs, works if people have too many permissions on Linux and in a myriad of other ways.
The companies I work for, security is always higher rated than convenience. You could buy several houses, or be settled for life, with the costs to cover an eventual security breach.
The companies I've consulted with had USB not secured in the Laptops of the marketing departments I've seen - and yes some of them lost several hundred millions of $ b/c of breaches in revenue.
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#54Adobe deserve a pile of the blame here for the pdf spec - it only requires the magic to appear in the first 1024 bytes[1] (and that %EOF appears in the last 1024) - thus allowing silly tricks like PDFs that are also another file type [2]. [1] http://www.adobe.com/content/dam/Adobe/en/devnet/acrobat/pdf... section 3.4.1 [2] https://www.slideshare.net/ange4771/a-binary-chimera
However, I think it's quite a stretch to put any blame on Adobe for this one.
In essence, Avast has implemented their own std::vec in C for the management of the magic numbers, and they implemented it quite poorly.
As mentioned in the article, the find_magicnums function supports roughly 300 (!) different magic numbers. Adobe's PDF is not required at all to exploit this bug.
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#55Earlier quoted context omitted.
The majority of customers I work with, that is part of the standard IT image, regardless which OS your computer might have.
Yes. And I guess non-glued usb ports on every computer. And users that put every USB stick in their computer they are handed by strangers in front of the office. Or they find on the printer. Especially when labeled "Pictures". Because CEO: Have we Antivirus installed? CIO: Yes. Not CEO: Are we secure? How does your risk analysis look like? Do we internal or perimeter defense? CIO: ...
Re: Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers
#56Earlier quoted context omitted.
Yes. And I guess non-glued usb ports on every computer. And users that put every USB stick in their computer they are handed by strangers in front of the office. Or they find on the printer. Especially when labeled "Pictures". Because CEO: Have we Antivirus installed? CIO: Yes. Not CEO: Are we secure? How does your risk analysis look like? Do we internal or perimeter defense? CIO: ...
"We have a password policy in place that forces our users to change their passwords to something long and random with lots of symbols in it no less than 50 characters every week - we're on the cutting edge of security!"