Re: Examples of lost security when integrating (secure) SW

Hello,

in Andrew Tanenbaum's book about Operating Systems, in
Chapter 5  FILE SYSTEMS ->  5.4 Security -> 5.4.2 Famous Security Flaws

you can find a description of a problem in the TENEX operating system, 
where the interaction among two modules that acted independently in a 
reasonable way, produced a way to discovering passwords. The problem was 
related to the way passwords were checked, interacting with the way memory 
pages were managed, if I understand it correctly.

Hope this helps,

--
Fernando Tricas

  On Tue, 8 Jun 2004, Magnus Therning wrote:

> I just had a discussion with my colleagues regarding problems with
> security in larger systems that are composed by combining
> modules/components that individually are secure. Both my gut and sources
> I have consulted says this is the case. However, I haven't been able to
> find any examples of when this has happened!
>
> Bruce Schneier spends a few pages in Secrets & Lies on the subject,
> without offering any examples of what can happen. I seem to remember
> some talk on a conference (was it Usenix?) a few years ago__I never
> attended it but I read the abstract of the papers/talks--where a talk on
> security mentioned a case where the combination of two security features
> effectively cancelled each other.
>
> Can anyone offer any more concrete examples, ideally not only academic
> ones?
>
> /M
>
> --
> -----------------------------------------------------------------------
> Magnus Therning                 Philips Research Laboratories Eindhoven
> Phone: +31 40 2745179           (OpenPGP: 0x4FBB2C40)
>
> Some operating systems are called 'user friendly', Linux however is
> 'expert friendly'.
>

-- 
Fernando Tricas Garcia                 |  E-Mail: [email protected]
Depto. Informática e Ingeniería de Sistemas. CPS. Universidad de Zaragoza 
Maria de Luna,3 50018 Zaragoza (Spain) http://www.cps.unizar.es/~ftricas/