When are people going to stop using built-in and/or static arrays in network
daemons?  Haven't we seen enough array overrun attacks?  Every one of them
could have been prevented by simple coding practices.  For example, using a
string class!  I stopped using built-in and static arrays years ago and I
don't even write network daemons.  I stopped using them simply because they
are a proven source of bugs, bugs, bugs, nasty bugs.  Am I insane?

Mike
----- Original Message -----
From: <ming at mongo.evil-overlords.com>
To: <tclug-list at mn-linux.org>
Sent: Thursday, July 19, 2001 10:58 PM
Subject: Re: Re: [TCLUG] Lots of denied packets. Port 80


> Well I have only about 20 requests so far but they come from all over the
place
> some from europe some from asia some from very well known us
sites(bellsouth,
> ohio university, juno). By the way....very nice article.
>
> Jason
> >andy at theasis.com wrote:
> >>
> >> > > Just a worm looking for copies of IIS and hoping to exploit a
buffer
> >> > > overflow.  The requests start off with "GET /default.ida?NNNN..."
and
> >> > > are too large to be anything but a buffer overflow attempt.
> >> > >
> >> > > The only article I've been able to find about the worm is at
> >> > > http://www.newsbytes.com/news/01/168003.html?&_ref=923747745
> >> >
> >> > http://www.securityfocus.com/templates/headline.html?id=12004
> >>
> >> http://www.msnbc.com/news/602036.asp?cp1=1
> >
> >And of course last but not least a real in depth technical explination
> >of what codered is, what it does, and how it spreads instead of
> >newsflash fluff. ;P
> >
> >http://www.eeye.com/html/Research/Advisories/AL20010717.html
> >
> >Cute. Whoever wrote it knew their win32. The stuff in the GET line is
> >just a boostrap, the real worm code is in the rest of the HTTP request,
> >and thus not logged. I've written me a CGI to grab the complete virus
> >next time I get hit. Heh.
> >
> >I've gotten 21 attempts so far.
> >_______________________________________________
> >tclug-list mailing list
> >tclug-list at mn-linux.org
> >https://mailman.mn-linux.org/mailman/listinfo/tclug-list
> >
>
>