Messages in this thread | | | Date | Sat, 08 Aug 1998 01:18:45 -0400 | From | Joseph Malicki <> | Subject | Re: [Fwd: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds] |
| |
Rene Janssen wrote:
> At 04:54 PM 8/6/98 -0400, you wrote: > >IMPORTANT:: > > > >Now, this leads to a way to have a truly secure system: an EXPAND-UP > >STACK. With an expand up stack, where the ESP increments rather than > >decrements on a push, you can not overwrite the return address with > >the address of your own function. > > This doesnt save you from buffer underflows : > > void giant_bug(char *b) > { > char buf[256], *p=buf+256; > int x; > for (x=0;x<1024;++x) *p-- = *b++; > } > > expand-up stacks are not secure either.
Thats not the point.... and thats not very common code either... the point is an intentional root exploit.... and to do that in an underflow, you are checking for size, and PROBABLY checking that against the size of the buffer....
Joseph Malicki
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html
| |