Bugtraq mailing list archives
Re: Buffer overflow prevention
From: Mariusz Woloszyn <emsi () ipartners pl>
Date: Thu, 14 Aug 2003 19:26:47 +0200 (EEST)
On Thu, 14 Aug 2003, Stephen Clowater wrote:
Also, you can use chpax, and turn on a non-executable stack, and with a small amount of voodoo (in tracking down the binarys and .so's that need the stack, wich typically is only a single binary or .so file, wich you can find with ptrace, strace, or ltrace) you can have all of your stuff run with a non-executeable stack, thus making stack smashing impossible. Nothing can execute off your stack so a malicous person can override all the addresses he wants, his code cant run off your stack.
It's been proved many times that non-executable stack adds NO security at all. Every single class of vulnerabilities exploitable with executable stack can be also exploited with non-executable stack. See for example our article (http://www.phrack.org/show.php?p=56&a=5) which shows how to bypass a stack protector even with a non-executable stack. What we're discussing here is an internal structures and data protecting. IMHO the ProPolice (http://www.research.ibm.com/trl/projects/security/ssp/), is the best protection in this kind, even comparing to "two stack" approach. Beside that it's an existing, well tested and wide used (for example OpenBSD uses it by default now). I see no real reason why the major Linux companies are not using it for its products. Best regards, -- Mariusz Woloszyn Internet Security Specialist, GTS - Internet Partners
Current thread:
- Re: Buffer overflow prevention, (continued)
- Re: Buffer overflow prevention Patrick Dolan (Aug 13)
- Re: Buffer overflow prevention Mariusz Woloszyn (Aug 14)
- Re: Buffer overflow prevention Crispin Cowan (Aug 14)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- RE: Buffer overflow prevention Lance James (Aug 14)
- Re: Buffer overflow prevention Patrick Dolan (Aug 14)
- Re: Buffer overflow prevention Jedi/Sector One (Aug 14)
- Re: Buffer overflow prevention Stephen Clowater (Aug 14)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention Solar Designer (Aug 15)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention Mariusz Woloszyn (Aug 14)
- Re: Buffer overflow prevention Theo de Raadt (Aug 14)
- Re: Buffer overflow prevention Matt D. Harris (Aug 14)
- Re: Buffer overflow prevention sauron (Aug 14)
- Re: Buffer overflow prevention Timo Sirainen (Aug 14)
- Re: Buffer overflow prevention Jedi/Sector One (Aug 14)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention Theo de Raadt (Aug 14)
- Re: Buffer overflow prevention Jedi/Sector One (Aug 14)
- Re: Buffer overflow prevention Miod Vallat (Aug 14)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention stealth (Aug 15)
- Re: Buffer overflow prevention Patrick Dolan (Aug 13)