"JE" == Jeff Epler <jepler@unpythonic.dhs.org> writes:
JE> On Mon, Feb 25, 2002 at 11:25:48PM +0100, Martin v. Loewis JE> wrote: >> That's not a vulnerability. It assumes that the translator is >> an attacker, or that the attacker can change the catalogs. If >> he is or can, you could not trust them, anyway, as they could >> cause arbitrary other failures, as well. JE> It means that you must audit not only your source code, but JE> also your message catalogs, to determine whether information JE> that is supposed to remain internal to a program is not JE> formatted into a string. Of course, it is fairly easy to do JE> this audit by showing that the translated string doesn't JE> contain substitution on any identifiers that the original JE> string did not.