Please note that the following attack vector may be present in any and all "shoe" like devices and systems.
http://www.0x90.org/releases/laces0dayAdv.txt Shoe 1.0 - Remote Lace Overflow -------------------------------------------- This Vulnerability is in reference to the new class of remote vulnerabilities indicated in: http://www.securityfocus.com/archive/1/385078/2004-12-19/2004-12-25/2 [Please read that first] Discovery Credited To: ---------------------- freshman - 0x90.org wxs - 0x90.org txs - 0x90.org Greets: ------- Jonathan T. Rockway for being the smartest man alive. Description: ------------ A remote shoe vulnerability exists that could allow for remote tripping and possible exposure of sensitive data to the pavement. Scope: ------ REMOTE Severity: --------- Hyper-Critical. This needs no explanation. Vulnerability: -------------- Failure to properly tie your shoe could result in tripping and a possible broken face upon sudden deceleration when hitting the pavement. Vulnerable Sizes: ----------------- 6 through 13. Other sizes may be vulnerable, but were unavailable for testing. Exploitation: ------------- You have a 100% secure walking system - you do not fall down, or trip over your own laces. A remote attacker could determine your shoe size by reading your livejournal FROM THE NETWORK and could MAIL YOU a shoe with extra long laces. You put the shoe on without tying it properly and suddenly are exposed to a REMOTE shoe vulnerability! Fix: ---- Do not wear untrusted shoes sent to you. Other possible workarounds include sandals (aka. flip-flops). These are a good work-around and are widely available for those concerned about their security. Vendor Notification: -------------------- Vendors were not notified at the time of this writing. We have choosen not to give advance notice because the fault is not always with the vendor of the shoe as a REMOTE PERSON could SNAIL MAIL a LOCAL USER a vulnerable shoe. We at 0x90.org believe that the users should be happy they were notified about this. Imagine the mass destruction and chaos that would ensue if we unleashed a REMOTE SHOE VULNERABILITY WORM into the wild. At this time we have choosen not to do that, mostly because we can not afford all the stamps to mail vulnerable shoes to the public. props to the 0x90 guys for identifying, analyzing and releasing this critical information, if it wasn't for ground breakers such as this the interwebz may end up being destroyed by such careless systems engineering. Dre On 9/8/05, y0himba <[EMAIL PROTECTED]> wrote: > Is "Shoe 20" a hardened foot protection? > > -----Original Message----- > From: Ted Frederick [mailto:[EMAIL PROTECTED] > Sent: Thursday, September 08, 2005 12:55 PM > To: y0himba; [email protected]; Dan Mack; Tim Doyle > Subject: RE: [Full-disclosure] Security Hole Found In Dave's Sock > > Dear list, > > I know that this list is not meant for personal promotion but I think I > would be remiss if I did not mention that my company has recently released > an upgrade to our initial offering of Shoe 1.0. The upgrade to Shoe 2.0 > includes a firewall/anti-virus product previously known as Sock 3.4563.v54. > > The upgrade cost is $19.99. There is also a required software assurance > subscription of $325.79 monthly. > > If all goes well with the new product I suspect that we will be purchased by > a major software vendor before year end thus making updates available on the > first Tuesday of every month to protect against further holes. These > updates will have vague names with no indication of what they actually fix > which should relieve you of sparing any thought to what risks you may have > been exposed to prior to the patch. > > Yes, we have in fact thought of everything so you don't have to. > > Ted > > > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of y0himba > Sent: Thursday, September 08, 2005 12:44 PM > To: [email protected] > Subject: RE: [Full-disclosure] Secuirty Hole Found In Dave's Sock > > What version socks are these? What type? 4? 4a? 5? > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Dave Cawley > Sent: Thursday, September 08, 2005 12:29 PM > To: Craig, Tobin (OIG); [email protected] > Subject: RE: [Full-disclosure] Secuirty Hole Found In Dave's Sock > > It's hard to get the socks from different pairs to sync up. > This can cause confusion for people viewing the socks and in turn cause a > high volume of inquiries to the system administrator. > But I'll give it the old college try. Thanks for the input! > > *************************************************************** > Dave D. Cawley | > High Speed Internet | The number of Unix installations > Duryea, PA | has grown to 10, with more expected. > (570)451-4311 x104 | - The Unix Programmer's Manual,1972 > [EMAIL PROTECTED] | > *************************************************************** > URL => http://www.adelphia.net > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
