lkml.org 
[lkml]   [1999]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Unexecutable stack
"Richard B. Johnson" wrote:
>
> On Mon, 27 Dec 1999, Steve VanDevender wrote:
>
> > Richard B. Johnson writes:
> > > The notion of a secure stack implies that you get some kind of security
> > > by making the stack non-executable. This theory has, to the best on
> > > my knowledge, never been shown to have merit, much less proof. The
> > > old games of loading executable opcodes into local data on the stack,
> > > overwriting the return address with that data (to point to the code
> > > you want to execute), then causing an exception (stack overrun) to
> > > make it happen, are not something you could encounter with the current
> > > network daemons.
> > >
> > > You would need a local account, with root access, to even experiment.
> >
> > I run a couple of large Solaris 7 systems with the
> > "noexec_user_stack" option enabled. This defeats nearly all root
> > exploits based on stack overflows; I've tried them and intruders
> > have tried them without success. Making the stack non-executable
> > really does help.
>
> So how many root exploits have you actually had? And, how many
> attempts? I have, at last count, 54 Suns, 126 Alphas, a few hundred
> ix86/Linux, plus slightly less than 1,000 Win/Win-NT machines on
> this very site where we have 1,200 engineering employees. Most
> all the Suns, Alphas, and Linux machines are not filtered by
> a firewall.
>
> We have never had a known, provable break-in of any kind, not
> counting the engineers blue-screening the Windows machines
> by throwing funny packets at them.

During the past year I had observed about 6 actual break-ins using
stack smashing on customer's _poorly_ administered systems (Out of about
50 boxes).
They where divided between imap and mountd at a ratio 1-1. So I think
the internet as a whole is a bit more hostile then what you are trying
to
suggest...

> > You don't quite seem to understand the mechanism of stack buffer
> > overflow exploits. The buffer overflow does not cause an
>
> I understand it exactly and precisely. It is likely that I was
> the first to demonstrate this in the late '70s.

Respect!

--Marcin

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.076 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site