Bugtraq mailing list archives
Re: [ANNOUNCE] glibc heap protection patch
From: William Robertson <wkr () cs ucsb edu>
Date: Tue, 2 Dec 2003 09:16:02 -0800
Hi Stefan, On Dec 02, 2003, at 06:03, Stefan Esser wrote:
Nice advertisement but you should underline the fact, that it only protects against glibc malloc()/free() problems. There are a number of software packages that implement their own heap wrappers or work with linked lists. They still are vulnerable to heap overflows. f.e. PHP.
This is correct, and we state as much in our LISA paper. Apologies for not emphasizing it more in my post yesterday; I'll make sure the project page makes this clearer.
And on the other hand there is a much simpler way to protect any unlink from a linked list from ever beeing exploited.
This is true in the case of the fd and bk pointers, and in fact this is one of the checks that dlmalloc's debugging code performs. However, as we also demonstrated in the paper, you are still open to other heap-related attacks, such as overwriting size fields and setting up fake chunk headers. So, unfortunately I don't think that check alone is sufficient.
Stefan Esser
-- William Robertson Reliable Software Group, UC Santa Barbara http://www.cs.ucsb.edu/~wkr/
Current thread:
- [ANNOUNCE] glibc heap protection patch William Robertson (Dec 01)
- Re: [ANNOUNCE] glibc heap protection patch Stefan Esser (Dec 02)
- Re: [ANNOUNCE] glibc heap protection patch William Robertson (Dec 02)
- Re: [ANNOUNCE] glibc heap protection patch Stefan Esser (Dec 03)
- Re: [ANNOUNCE] glibc heap protection patch William Robertson (Dec 03)
- Re: [ANNOUNCE] glibc heap protection patch William Robertson (Dec 02)
- Re: [ANNOUNCE] glibc heap protection patch Stefan Esser (Dec 02)
- Re: [ANNOUNCE] glibc heap protection patch Eugene Tsyrklevich (Dec 02)
- Re: [ANNOUNCE] glibc heap protection patch William Robertson (Dec 02)
- Re: [ANNOUNCE] glibc heap protection patch Han Boetes (Dec 03)
- Re: [ANNOUNCE] glibc heap protection patch Adam Shostack (Dec 04)
- Re: [ANNOUNCE] glibc heap protection patch Jim Knoble (Dec 04)
- Re: [ANNOUNCE] glibc heap protection patch William Robertson (Dec 02)
- Message not available
- Re: [ANNOUNCE] glibc heap protection patch William Robertson (Dec 04)
- <Possible follow-ups>
- Re: [ANNOUNCE] glibc heap protection patch xenophi1e (Dec 03)
- Re: [ANNOUNCE] glibc heap protection patch Stefan Esser (Dec 04)