lkml.org 
[lkml]   [2000]   [Jul]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: disk-destroyer.c
    On Fri, 21 Jul 2000, Myrddin Emrys wrote:

    > On Fri, 21 Jul 2000 00:44:10 -0700 (PDT) you sent this message:
    >
    > >On Fri, 21 Jul 2000, Oliver Xymoron wrote:
    > >
    > >> No, of course not, but we also don't want to make large changes to the
    > >> kernel to paper over a hole that we can't cement closed. Especially now.
    > >
    > >Here is you damn steel-plate-of-armor!
    > <snip>
    > >Damn-it here is you CEMENT!!!!!!!!!
    >
    > It's cement for one hole that you know exists... what about a dozen others
    > you don't? There's probably two dozen documented other places where you can
    > fry some subsystem or another. Protecting the system against a malicious
    > root is an exercise in futility. No matter what you do, how you guard the
    > system, root can bypass it. This is by design, as you well know. That is how
    > Linux (and most *nix) works.
    >
    > As oxy said, not now. Propose the patch after the next stable release.

    Brain dead are we, now that I know the argument better.....

    > > > Can disk-destroyer be pushed into a shellstack because it is so small?
    > > >
    > > Yes, it's true. It can be made even smaller, much smaller, than the
    > > compiled size of the code. Although the limits on how much shellcode
    > > you can send in a buffer overrun do vary, I expect this will almost
    > > certainly fit in just about every buffer overrun I've seen.

    Here is your SECURITY HOLE!

    JOE-SIX-PACK-HACKER can fry your butt.

    Cheer,

    Andre Hedrick
    The Linux ATA/IDE guy


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:57    [W:4.025 / U:0.284 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site