Messages in this thread | | | Date | Fri, 7 Aug 1998 09:59:17 -0400 (EDT) | Subject | Re: [Fwd: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds] | From | (Kragen) |
| |
On Fri, 7 Aug 1998, Rene Janssen wrote: > At 04:54 PM 8/6/98 -0400, you wrote: > >IMPORTANT:: > > > >Now, this leads to a way to have a truly secure system: an EXPAND-UP > >STACK.
This is a foolish statement. As long as minor programming bugs result in attackers being able to overwrite arbitrary memory, you don't have a "truly secure system".
> >With an expand up stack, where the ESP increments rather than > >decrements on a push,
Methinks thou art not well-versed in the ways of Intel iAPX86 assembly.
> This doesnt save you from buffer underflows : > void giant_bug(char *b) > { > char buf[256], *p=buf+256; > int x; > for (x=0;x<1024;++x) *p-- = *b++; > } > > expand-up stacks are not secure either.
I suspect that this kind of bug is three or four orders of magnitude less common than the traditional buffer overflow, though.
Kragen
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html
| |