Messages in this thread | | | Date | Thu, 30 Dec 1999 22:42:49 -0500 | From | "Theodore Y. Ts'o" <> | Subject | Re: Unexecutable Stack / Buffer Overflow Exploits... |
| |
Date: Thu, 30 Dec 1999 19:37:39 -0800 (PST) From: Dan Hollis <goemon@sasami.anime.net>
Is there any reason we cant do the first 2 immediately?
FWIW I thought solar designer patch did do the first one.
No, the Solar Designer patch arranges things so that the default location of shared libraries is mapped in such that they contain a 0x00 in their address. I'm suggestiong that we do the same with the stack. This makes it a lot harder to change the return address to be a location on the stack (although someone could still change the return address to be anywhere else in the program text segment.)
(BTW, changing the location of the shared library is only marginally useful. As I pointed out in an earlier e-mail message, all you have to do is find a location in the text segment which involves a call to execv (or chmod, or some other other convenient library routine) and then patch the return address of a stack frame to return to that call instruction.)
- Ted
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |