Re: 18th anniversary of Internet worma.k.a.Morris worm

["Dave \"No, not that one\" Korn" <davek_throwaway () hotmail com>]

Valdis.Kletnieks () vt edu wrote:
> On Sun, 12 Nov 2006 18:21:16 GMT, "Dave \"No, not that one\" Korn" said:
> > Georgi Guninski wrote:
> > > my question was:
> > >
> > > when was the first provable *public* (as in common sense)
> > > announcement of the exploitability of buffer overflows.
> >
> >   The use of smashing the stack to seize control of the program flow was 
> > in
> > everyday usage on the Commodore PET from around 1979-1980ish.  It was 
> > our
> > standard technique for making programs autorun after loading!
>
> Was that a "classic" smash-the-stack, where an overly long paramater is 
> used
> to over-write the return pointer, or were you guys just intercepting the
> return pointer directly?

  Well, it wasn't a parameter, but it was overwriting the return pointer. 
Everything lived at absolute addresses on that machine, there being no 
dynamic allocation or memory management.  The stack lived a short distance 
in memory below the area reserved for program code.  By setting the 
(absolute) load address of your program a couple of pages lower than usual, 
the first thing that got loaded was your stack, then your program area, so 
you could overwrite the stack with an address in the code region and as soon 
as the kernel's tape load routine returned you seized control.

> If the latter, I'm pretty sure there was software
> that would overlay return pointers in order to redirect program flow as 
> far
> back as IBM's OS/360 in the 1967-75 timeframe.

  Indeed, and there's also the age-old technique of implementing a computed 
goto by pushing the address on the stack and executing a ret (rts for you 
old 6502 heads out there) instruction.

  This is all kind of tangential to Georgi's question about when the first 
public announcement was made, but the point I'm getting at is that the 
general principles of stack manipulation to control program flow either 
deliberately or unexpectedly had been in the air for some time; so no matter 
when the first public announcement of *a* stack-smashing buffer overflow 
vulnerability was made, it would already have been common knowledge that 
buffer overflows *in general* could be used to manipulate the stack; I don't 
suppose there was one initial announcement and then suddenly everyone 
realised the stack could be smashed, I reckon lots of people were gradually 
putting two and two together independently.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today.... 



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/