Messages in this thread | | | Date | Thu, 30 Dec 1999 13:43:33 +0100 (CET) | From | "Homme R. Bitter" <> | Subject | Re: Unexecutable Stack / Buffer Overflow Exploits... |
| |
On Wed, 29 Dec 1999, Horst von Brand wrote:
> And note that the latest round of attacks against Solaris bind (I never run > stock distribution servers as a policy matter, they usually lag _way_ > behind in security) gave me a _huge_ /var/adm/messages, full of messages > from bind that was being bombarded with many thousands of weird requests. > Installing nonexecutable stack would have given me a whole bunch of nice > core files, and a nameserver that did not work for more than a couple of > seconds at a time. That isn't exactly "security" in my book.
Solaris != linux The openwall/Solar Designer patch works with bind. No sense in comparing Solaris with a patch that works in quite a different way on linux. Try it out on a non production box and see if you can break it, then start comparing those results with an unmodified linux kernel. If you succeed in that, please let us and Solar Designer know, until then, please keep the fact that it doesn't work on solaris out of it, we are not interestend in solaris.
> A bit of extra security, at the cost of adding cruft to the kernel each > time a new trampoline code layout comes around, some performance hit for > everybody and DoSes all over the place instead of getting the broken > programs fixed? No, thanks.
So don't tag the "unexecutable stack" option while you compile your kernel and live happy without it. Have someone try a lame scriptkiddy attack on you and see your logfiles unchanged. It's a choice, not a default.
---------------------------draw-conclusion-here------------------------ Homme R. Bitter *NIX admin, BOFH, MCSE, parttime divine entity.
Best before jan. 1 1900
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |