CA Security Response Blog

The Full-Disclosure mailing list is good for interesting, and often humorous, content on a daily basis.  The highlight of the week last week was a link to a paper entitled "Automatic Patch-Based Exploit Generation", by David Brumley, Pongsin Poosankam, Dawn Song, and Jiang Zheng.  From the abstract ... "In this paper, we propose techniques for automatic patch-based exploit generation, and show that our techniques can automatically generate exploits for vulnerable programs based upon patches provided via Windows Update. [...] Attackers can simply wait for a patch to be released, use these techniques, and with reasonable chance, produce a working exploit within seconds. Coupled with a worm, all vulnerable hosts could be compromised before most are even aware a patch is available, let alone download it."  2008 is going to be an interesting year for security enthusiasts.

Edited to add:  Halvar.Flake has a blog post with very insightful commentary on the paper.