Slashdot Mirror
Word 2007 Flaws Are Features, Not Bugs
PetManimal writes "Mati Aharoni's discovery of three flaws in Word using a fuzzer (screenshots) has been discounted by Microsoft, which claims that the crashes and malformed Word documents are a feature of Word, not a bug. Microsoft's Security Response Center is also refusing to classify the flaws as security problems. According to Microsoft developer David LeBlanc, crashes aren't necessarily DoS situations: 'You may rightfully say that crashing is always bad, and having a server-class app background, I agree. Crashing means you made a mistake, bad programmer, no biscuit. However, crashing may be the lesser of the evils in many places. In the event that our apps crash, we have recovery mechanisms, ways to report the crash so we know what function had the problem, and so on. I really take issue with those who would characterize a client-side crash as a denial of service.' Computerworld's Frank Hayes responds to LeBlanc and questions Microsoft's logic.'"
What's the matter? Did the Slashdot editors lose their English-to-Microsoft dictionary again?
Um, it's defined in the twelve words after "fuzzer" in TFA
"a tool that probes an application for vulnerabilities by sending random input"
This is known as an appositive phrase.
My turnips listen for the soft cry of your love
I wish I could just pass out when my wife asks me some stupid question that I don't want to answer. Better yet, when I'm asked to fix a bug at work, it would be nice to just roll over and hit the snooze. Let's apply this everywhere.
"Please, shut up. Just when I think you can't say anything more stupid, you speak again." -Archie Bunker.
I hope you're not serious; if you are, I'm never letting you near any code I'm responsible for.
By definition, the app crashing is a denial of service. It's no different than sending a Christmas tree packet to an ancient unpatched router: it goes boom, shuts down the network, no network service. Word crashes: boom, document maybe lost, no use of Word.
A program must be able to recognize invalid input and take appropriate action. Allowing (or forcing) a crash is NOT acceptable.
"Honey, it's not working out; I think we should make our relationship open-source."
Sony ha
Sorry, I don't buy it. The only way that is a valid expectation is if you explicitly tell it to crash when it gets malformed data, which is offensive and stupid. The proper thing to do is to tell it to alert the user if there is malformed data, and then clean up and get ready to parse another document.
Crashing is definitely a sign that something bad is happening. Traditionally, when an app crashes because of an invalid document, it's writing to some memory it shouldn't be. This is a sign of lazy or stupid programmers not doing proper checking of the input.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The Open BSD guys have a philosophy: "The only difference between a bug and a vulnerability is the intelligence of the attacker."
I wish more programmers held this view! A bug is an undefined state of the program. It's quite clear that this is a dangerous position for your program to be in. Bug really are baby vulnerabilities. It's best to remove them as soon as you find them.
Simon
The old Apple ][ Reference Manual included a few pages of technical terms, with definitions. Buried among entries like track, sector, stack, and interrupt was this gem:
feature n. A bug, as described by the marketing department.
Breakfast served all day!
Apparently that specific line of text exploits the way that notepad determines whether the file is encoded in ASCII or Unicode.