Blind Remote Buffer Overflow

[lamont () ICOPYRIGHT COM (Granquist, Lamont)]

What does a theoretically feasible attack of this nature look like?  Lets
say that you're up against a webserver that runs some CGI C.  How do you
find and exploit a buffer overflow without having access to the code?

It seems that you first need to find a buffer overflow.  What is the
symptom here because when you dump core on one httpd proc then you'll just
spawn another one.  The service doesn't go down, so how do you know you
just caused the proc to core?

Then once you've found a buffer overflow, I guess you need to start
blindly guessing buffer sizes and locations until you get a winning
combination -- here the fact that webservers respawn would decidedly work
to your advantage.  You can also probably bet that the buffer size is damn
close to whatever size causes the proc to core, if you can determine that.

Can anyone flesh this out further, or knock big holes in this process, or
think of a radically different approach which is better?  Then, how can
you make it even harder to exploit these kinds of holes blindly?