lkml.org 
[lkml]   [1999]   [Dec]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Unexecutable stack
On Mon, 27 Dec 1999, Steve VanDevender wrote:

> Richard B. Johnson writes:
> > The notion of a secure stack implies that you get some kind of security
> > by making the stack non-executable. This theory has, to the best on
> > my knowledge, never been shown to have merit, much less proof. The
> > old games of loading executable opcodes into local data on the stack,
> > overwriting the return address with that data (to point to the code
> > you want to execute), then causing an exception (stack overrun) to
> > make it happen, are not something you could encounter with the current
> > network daemons.
> >
> > You would need a local account, with root access, to even experiment.
>
> I run a couple of large Solaris 7 systems with the
> "noexec_user_stack" option enabled. This defeats nearly all root
> exploits based on stack overflows; I've tried them and intruders
> have tried them without success. Making the stack non-executable
> really does help.

So how many root exploits have you actually had? And, how many
attempts? I have, at last count, 54 Suns, 126 Alphas, a few hundred
ix86/Linux, plus slightly less than 1,000 Win/Win-NT machines on
this very site where we have 1,200 engineering employees. Most
all the Suns, Alphas, and Linux machines are not filtered by
a firewall.

We have never had a known, provable break-in of any kind, not
counting the engineers blue-screening the Windows machines
by throwing funny packets at them.

>
> You don't quite seem to understand the mechanism of stack buffer
> overflow exploits. The buffer overflow does not cause an

I understand it exactly and precisely. It is likely that I was
the first to demonstrate this in the late '70s.

Cheers,
Dick Johnson

Penguin : Linux version 2.3.13 on an i686 machine (400.59 BogoMips).
Warning : The end of the world as we know it requires a new calendar.
Seconds : 363688 (until Y2K)


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [from the cache]
©2003-2011 Jasper Spaans