Messages in this thread | | | Subject | Re: Is there any Buffer overflow attack mechanism that can break a vulnerable server without breaking the ongoing connection? | From | Arjan van de Ven <> | Date | Mon, 26 Dec 2005 21:51:21 +0100 |
| |
On Mon, 2005-12-26 at 15:47 -0500, Xin Zhao wrote: > We are working on a mechanism that monitors the connections of a > server and detects potential intrusions via broken connection > (incoming request received, but no reply). We want to thoroughly > understand the possibility of mounting a buffer overflow attack > against a server process without cutting off the connection.
buffer overflows do not break connections, and as such I think you are out of luck. Having said that.. on modern linux distros it's pretty hard to do a buffer overflow exploit nowadays (NX[1] to make stacks non-executable, randomisations, compiler based detection (via FORTIFY_SOURCE and/or -fstackprotector)... add all those together and it's certainly not easy to do this....
[1] or emulations of NX such as segment limits techniques
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |