On Fri, 29 Jul 2005 18:57:15 CDT, "J.A. Terranson" said: > This has nothing to do with the choice of "a general purpose CPU", it is a > result of a specific architecture within the CPU chosen. There is a real > difference here. Actually, although I've flamed Jason quite a bit, he *is* right in that the use of *any* general purpose processor implies these sorts of vulnerabilities. The *exact* results depend on things like the ABI they chose to use. However, saying "If they had used a different stack layout or different procedure call conventions, none of this would have happened" is disingenuous. If you have an ABI on anything we'd consider a "general purpose CPU", you have these same *classes* of vulnerabilities. The only way you can get rid of them is either to not use a CPU at all (the FPGA/ASIC solution), or go with some exotic architecture like Intel's iAXP432(*) or the IBM S/38, which are both "tagged" architectures, but hardly qualify as "general purpose". Given the other choices, I can hardly say Cisco is guilty of *negligence*. (On the other hand, if they used the word 'Unbreakable' to describe their product, false advertising may be an issue.. ;) (*) OK, so the 432 wasn't *really* able to provide much more than a hardware implementation of Pascal-style type checking - the hidden 'gotcha' is that it's fiendishly difficult to do operating system level coding on any sort of B&D processor, because you can't typecast easily - and things like IOS are almost entirely operating system level stuff... In addition, you get the performance penalties of hardware type checking....)
Attachment:
pgpnBkjUbPUuw.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/