Full Disclosure mailing list archives
RE: Coming soon: CPU fix for buffer overflows
From: Mike Barushok <mikehome () kcisp net>
Date: Mon, 23 Feb 2004 20:38:00 -0600 (CST)
On Mon, 23 Feb 2004, hybriz wrote:
Subject: RE: [Full-disclosure] Coming soon: CPU fix for buffer overflows From: "Richard M. Smith" <rms () computerbytesman com> Date: Mon, 23 Feb 2004 15:39:10 -0500 To: <hybriz () rego-security com> Let's get to the bottom line. Would this page execution bit scheme stop stuff like the Blaster worm? RichardIMHO, if the page-wise non-exec stack was implemented in win2k>= during the blaster period the blaster worm as we know it obviously would not exist. thing is, the timeline substitute would use diferent exploiting techniq to have the same effect. non-exec stack doesnt stop ALL buffer overflow attacks/techniqs, win2k+3 has a stack protection and it has been proven to be bypassable. The blaster worm wouldnt exist as we know it, an analogous substitute would. the execution bit exists on other archs but it doesnt mean that exploitation of stack based overflows isnt possible, it's just slightly (IMHO) more difficult and there are less possible attack vectors (for example, the ret-into-libc techniq will fail if the binary is stacticly linked). btw, in my country brought better 'security' to overall networks and home users since many started using pseudo-well configured by default firewalls and in a way that wouldnt happen if the stupid worm didnt have broken shellcode and 'non-universal' offsets. regards, hybriz
If a system built with a particulare new CPU cannot be made to perfectly emulate any other 'general purpose computer' that is equivalent to a Turing machine, then the new system (with the new CPU) is no longer a general purpose computer. There is also the mathematical theorem by Kurt Godel (anglicized spelling, apologies in advance) that implies that no amount of adding axioms to a sufficiently general and consistent system of Logic makes the unproveablility of all false theorems possible. So, the easiest way to reconcile the apparent fallacy is to deduce that adding an 'execute' flag will only make the next generation of buffer overflows a little more difficult. (Note to the non-mathematically inclined: Yes, it might seem difficult to believe, but a 4004 processor combined with unlimited (countable) storage, can emulate the fastest super computer, just not in 'real time'). _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Coming soon: CPU fix for buffer overflows Richard M. Smith (Feb 23)
- Re: Coming soon: CPU fix for buffer overflows Ralf Ertzinger (Feb 23)
- Re: Coming soon: CPU fix for buffer overflows William Warren (Feb 23)
- <Possible follow-ups>
- Re: Coming soon: CPU fix for buffer overflows hybriz (Feb 23)
- RE: Coming soon: CPU fix for buffer overflows hybriz (Feb 23)
- RE: Coming soon: CPU fix for buffer overflows Mike Barushok (Feb 23)
- RE: Coming soon: CPU fix for buffer overflows Michael Williamson (Feb 24)
- RE: Coming soon: CPU fix for buffer overflows Mike Barushok (Feb 23)
- Re: Coming soon: CPU fix for buffer overflows Helmut Hauser (Feb 24)
- Re: Re: Coming soon: CPU fix for buffer overflows Jeremiah Cornelius (Feb 24)