lkml.org 
[lkml]   [1999]   [Dec]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Unexecutable Stack / Buffer Overflow Exploits...
On Wed, 29 Dec 1999, Horst von Brand wrote:

> And note that the latest round of attacks against Solaris bind (I never run
> stock distribution servers as a policy matter, they usually lag _way_
> behind in security) gave me a _huge_ /var/adm/messages, full of messages
> from bind that was being bombarded with many thousands of weird requests.
> Installing nonexecutable stack would have given me a whole bunch of nice
> core files, and a nameserver that did not work for more than a couple of
> seconds at a time. That isn't exactly "security" in my book.

Solaris != linux
The openwall/Solar Designer patch works with bind.
No sense in comparing Solaris with a patch that works in quite a different
way on linux.
Try it out on a non production box and see if you can break it, then start
comparing those results with an unmodified linux kernel.
If you succeed in that, please let us and Solar Designer know, until
then, please keep the fact that it doesn't work on solaris out of it, we
are not interestend in solaris.

> A bit of extra security, at the cost of adding cruft to the kernel each
> time a new trampoline code layout comes around, some performance hit for
> everybody and DoSes all over the place instead of getting the broken
> programs fixed? No, thanks.

So don't tag the "unexecutable stack" option while you compile your kernel
and live happy without it.
Have someone try a lame scriptkiddy attack on you and see your logfiles
unchanged.
It's a choice, not a default.


---------------------------draw-conclusion-here------------------------
Homme R. Bitter *NIX admin, BOFH, MCSE, parttime divine entity.

Best before jan. 1 1900


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.092 / U:3.676 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site