3 ms·
Raymond Chen in this article seems to rather minimize the severity of arbitrary code execution attacks allowed by buffer overruns. His logic is also faulty sin
by twhitmore 6y ago
Raymond Chen in this article seems to rather minimize the severity of arbitrary code execution attacks allowed by buffer overruns.
His logic is also faulty since he conflates 'End-User' permitted capabilities (what the App correctly allows the user/ request to do) with Application permissions to the OS.
Really this seems like it might be blinded by too many years of C/ C++ & immersion in stale campus group-think.
- LoSboccacc 6y agoit's not arbitrary, this program execs what the user asks it to exec. if some non user can get it to exec something the user doesn't want it to exec, then yeah, it can be a problem. but a non user has to go trough the user to have the dll in place, so the problem is the user and the vector social engineering, not a vulnerability.