lkml.org 
[lkml]   [1998]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds


On Tue, 4 Aug 1998 dgaudet-list-linux-kernel@arctic.org wrote:
>
> libc is remapped by the patch so that the most significant byte of the
> addresses are 0. Thus you're able to form exactly one libc address for
> pretty much all string operations. That makes it a little more
> challenging to set up the stack.

Not really. You're attacking some known broken version of some specific
program anyway ("ftpd" or whatever - you need a point of contact), which
means that you're by no means limited to libc entrypoints.

I chose libc mainly because it's the obvious choice, but your example
makes it just all the more clear that the whole approach of the patch is
not to fix real problems, but to fix specific attacks that really should
have been fixed in the binary.

Linus


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.055 / U:0.136 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site