Re: PointGuard: It's not the Size of the Buffer, it's the Address of the Pointer

[Crispin Cowan <crispin () immunix com>]

Florian Weimer wrote:

> Crispin Cowan <crispin () immunix com> writes:
>  
>
> > Thanks to Snax and the Shmoo for a better tag line: It's not the Size
> > of the Buffer, it's the Address of the Pointer
> >    
> This is not true.  There are buffer overflow exploits which do not
> modify pointers, but other objects.  The most prominent example is
> probably the "c c c c c..." exploit for the Solaris /bin/login
> vulnerability.
Please address technical commentary to the paper (which addresses this 
point) and not to the cute tag line.

WRT this point: correct, PointGuard does not stop all buffer overflows. 
IMHO it *nearly* stops all shell code. To bypass PointGuard, you have to 
corrupt the logic of the program itself to get its own code to do what 
you want; you can't readily generate a jump to arbitrary code.

Caveat: I can't prove the above, and someone may generate a bypass. But 
I don't know of one.

Crispin

--
Crispin Cowan, Ph.D.           http://immunix.com/~crispin/
Chief Scientist, Immunix       http://immunix.com
           http://www.immunix.com/shop/