Re: [CD] CD Proposal: SF-EXEC (Software flaws in multiple executables)

[aleph1@securityfocus.com]

> 4) If the method of exploitation for P1 and P2 is the same (with the
>    exception of which executable is exploited), and the results of the
>    exploitation are the same, then P1 and P2 should be MERGED.

Ditto as my message in response to SF-LOC.

> *********************************************
> 
> CAN-2000-0213 (Sambar server, ECHO.BAT and HELLO.BAT both call "echo"
> and support metacharacters).
> 
> SF-EXEC.4, SF-EXEC.6, and SF-EXEC.7 suggest MERGE.  The "patch" is to
> delete the batch files, both of which contain the same vulnerable
> "echo" command.

This is what I am talking about. You are merging these two simply
because they have the same problem and can be exploited the same way
but they clearly share no code. You would run into the same problem
with things like system() calls in applications or metacharacters of CGI
programs while opening files. They are so common and you can exploits pretty
much each one in the same way you want to merge them. But they are each a
different vulnerability. I would vote to SPLIT these two.

-- 
Elias Levy
SecurityFocus.com
http://www.securityfocus.com/
Si vis pacem, para bellum