Messages in this thread | | | Date | Tue, 28 Dec 1999 09:56:18 +0100 | From | Martin Dalecki <> | Subject | Re: Unexecutable stack |
| |
"Richard B. Johnson" wrote: > > On Mon, 27 Dec 1999, Steve VanDevender wrote: > > > Richard B. Johnson writes: > > > The notion of a secure stack implies that you get some kind of security > > > by making the stack non-executable. This theory has, to the best on > > > my knowledge, never been shown to have merit, much less proof. The > > > old games of loading executable opcodes into local data on the stack, > > > overwriting the return address with that data (to point to the code > > > you want to execute), then causing an exception (stack overrun) to > > > make it happen, are not something you could encounter with the current > > > network daemons. > > > > > > You would need a local account, with root access, to even experiment. > > > > I run a couple of large Solaris 7 systems with the > > "noexec_user_stack" option enabled. This defeats nearly all root > > exploits based on stack overflows; I've tried them and intruders > > have tried them without success. Making the stack non-executable > > really does help. > > So how many root exploits have you actually had? And, how many > attempts? I have, at last count, 54 Suns, 126 Alphas, a few hundred > ix86/Linux, plus slightly less than 1,000 Win/Win-NT machines on > this very site where we have 1,200 engineering employees. Most > all the Suns, Alphas, and Linux machines are not filtered by > a firewall. > > We have never had a known, provable break-in of any kind, not > counting the engineers blue-screening the Windows machines > by throwing funny packets at them.
During the past year I had observed about 6 actual break-ins using stack smashing on customer's _poorly_ administered systems (Out of about 50 boxes). They where divided between imap and mountd at a ratio 1-1. So I think the internet as a whole is a bit more hostile then what you are trying to suggest...
> > You don't quite seem to understand the mechanism of stack buffer > > overflow exploits. The buffer overflow does not cause an > > I understand it exactly and precisely. It is likely that I was > the first to demonstrate this in the late '70s.
Respect!
--Marcin
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |