lkml.org 
[lkml]   [1998]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [Fwd: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds]
Rene Janssen wrote:

> At 04:54 PM 8/6/98 -0400, you wrote:
> >IMPORTANT::
> >
> >Now, this leads to a way to have a truly secure system: an EXPAND-UP
> >STACK. With an expand up stack, where the ESP increments rather than
> >decrements on a push, you can not overwrite the return address with
> >the address of your own function.
>
> This doesnt save you from buffer underflows :
>
> void giant_bug(char *b)
> {
> char buf[256], *p=buf+256;
> int x;
> for (x=0;x<1024;++x) *p-- = *b++;
> }
>
> expand-up stacks are not secure either.

Thats not the point.... and thats not very common code either... the
point is an
intentional root exploit.... and to do that in an underflow, you are
checking for
size, and PROBABLY checking that against the size of the buffer....

Joseph Malicki


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.063 / U:0.108 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site