Bugtraq mailing list archives
Re: Buffer overflow prevention
From: Peter Busser <peter () trusteddebian org>
Date: Fri, 15 Aug 2003 11:54:54 +0200
Hi!
AFAIK all those combined do bring real security against generic exploits."Real security" is not the word.
Even though PaX is better than W^X, it is far from being perfect.
PaX / Propolice / W^X / non-exec stacks don't solve bugs. What they do is to _abort_ execution of a process when it behaves abnormally. So instead of giving attackers the opportunity to run arbitrary code, you only give them the ability to cause a denial of service.
You could say they trade availability for integrity.
This kind of protection should be coupled with tools that automatically restart daemons when they crash (ex: daemontools and monit) to actually keep the service running when under attack. Still, all of this is a couple of unreliable band-aids.
A better way to deal with would be to automatically warn someone with enough information to easily find and fix the problem. Restarting the daemon makes the problem managable, but it won't solve the bug. Groetjes, Peter Busser -- The Adamantix Project Taking trustworthy software out of the labs, and into the real world http://www.adamantix.org/
Current thread:
- Re: Buffer overflow prevention, (continued)
- Re: Buffer overflow prevention Jedi/Sector One (Aug 14)
- Re: Buffer overflow prevention Stephen Clowater (Aug 14)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention Solar Designer (Aug 15)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention Mariusz Woloszyn (Aug 14)
- Re: Buffer overflow prevention Theo de Raadt (Aug 14)
- Re: Buffer overflow prevention Matt D. Harris (Aug 14)
- Re: Buffer overflow prevention sauron (Aug 14)
- Re: Buffer overflow prevention Timo Sirainen (Aug 14)
- Re: Buffer overflow prevention Jedi/Sector One (Aug 14)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention Theo de Raadt (Aug 14)
- Re: Buffer overflow prevention Jedi/Sector One (Aug 14)
- Re: Buffer overflow prevention Miod Vallat (Aug 14)
- Re: Buffer overflow prevention Peter Busser (Aug 15)
- Re: Buffer overflow prevention stealth (Aug 15)
- Re: Buffer overflow prevention Mark Tinberg (Aug 18)
- Re: Buffer overflow prevention Crispin Cowan (Aug 18)
- Re: Buffer overflow prevention Peter Busser (Aug 18)
- Re: Buffer overflow prevention Crispin Cowan (Aug 15)