lkml.org 
[lkml]   [1999]   [Dec]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Unexecutable Stack / Buffer Overflow Exploits...
   Date: Thu, 30 Dec 1999 19:37:39 -0800 (PST)
From: Dan Hollis <goemon@sasami.anime.net>

Is there any reason we cant do the first 2 immediately?

FWIW I thought solar designer patch did do the first one.

No, the Solar Designer patch arranges things so that the default
location of shared libraries is mapped in such that they contain a 0x00
in their address. I'm suggestiong that we do the same with the stack.
This makes it a lot harder to change the return address to be a location
on the stack (although someone could still change the return address to
be anywhere else in the program text segment.)

(BTW, changing the location of the shared library is only marginally
useful. As I pointed out in an earlier e-mail message, all you have to
do is find a location in the text segment which involves a call to execv
(or chmod, or some other other convenient library routine) and then
patch the return address of a stack frame to return to that call
instruction.)

- Ted


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.730 / U:1.084 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site