4 ms·

For reference, it looks like he's referring to this: http://freecode.com/articles/suse-new-krb5-packages-fix-remote-code-execution-5 http://freecode.com/articl

• tptacek 14y ago
  If I wanted to play dirty, I'd have mentioned ASN.1. :)
  • thirsteh 14y ago
    Or allowing \0 in X.509 fields.
  • marshray 14y ago
    I agree, ASN.1 sucks in terms of implementation in security-critical contexts. But it's not a NIST or IETF standard, so it doesn't count. It's from ISO/IEC/ITU.
• marshray 14y ago
  Do you have a link to the code with the bug? I'll bet that "Specially crafted AES and RC4 packets" does not actually refer to the implementation of a NIST standard algorithm, just its usage in a context outside of such a standard.