Bugtraq mailing list archives
Re: Buffer overflow prevention
From: Timo Sirainen <tss () iki fi>
Date: Thu, 14 Aug 2003 22:17:29 +0300
On Thursday, Aug 14, 2003, at 20:26 Europe/Helsinki, Mariusz Woloszyn wrote:
On Thu, 14 Aug 2003, Stephen Clowater wrote:Also, you can use chpax, and turn on a non-executable stack, and with a smallIt's been proved many times that non-executable stack adds NO security atall. Every single class of vulnerabilities exploitable with executable stack can be also exploited with non-executable stack.
What he forgot to mention is that PAX and grsec also gives you non-executable heap and randomized address bases to prevent return-to-libc attacks. AFAIK all those combined do bring real security against generic exploits.
Current thread:
- RE: Buffer overflow prevention, (continued)
- RE: Buffer overflow prevention Lance James (Aug 14)
- Re: Buffer overflow prevention Patrick Dolan (Aug 14)
- Re: Buffer overflow prevention Jedi/Sector One (Aug 14)
- Re: Buffer overflow prevention Stephen Clowater (Aug 14)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention Solar Designer (Aug 15)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention Mariusz Woloszyn (Aug 14)
- Re: Buffer overflow prevention Theo de Raadt (Aug 14)
- Re: Buffer overflow prevention Matt D. Harris (Aug 14)
- Re: Buffer overflow prevention sauron (Aug 14)
- Re: Buffer overflow prevention Timo Sirainen (Aug 14)
- Re: Buffer overflow prevention Jedi/Sector One (Aug 14)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention Theo de Raadt (Aug 14)
- Re: Buffer overflow prevention Jedi/Sector One (Aug 14)
- Re: Buffer overflow prevention Miod Vallat (Aug 14)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention stealth (Aug 15)
- Re: Buffer overflow prevention Mark Tinberg (Aug 18)
- Re: Buffer overflow prevention Crispin Cowan (Aug 18)
- Re: Buffer overflow prevention Peter Busser (Aug 18)
- RE: Buffer overflow prevention Lance James (Aug 14)