[12172] in bugtraq
StackGuarded Red Hat 5.2 Released
daemon@ATHENA.MIT.EDU (Crispin Cowan)
Fri Oct 8 17:47:58 1999
Content-Type: text
Message-Id: <199910080030.RAA16612@church.cse.ogi.edu>
Date: Thu, 7 Oct 1999 17:30:43 -0700
Reply-To: Crispin Cowan <crispin@CSE.OGI.EDU>
From: Crispin Cowan <crispin@CSE.OGI.EDU>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
We have just released the (long-awaited :-) StackGuarded Red Hat 5.2 Linux
distribution. We have also moved. The new home page for StackGuard in
particular, and Immunix in general, is now:
http://immunix.org/
About WireX StackGuard:
StackGuard is a compiler for producing programs that are resistant to
the "stack smashing" variety of buffer overflow attacks. StackGuard
does this by emitting code to do integrity checks on the stack for
every function call. If the activation record has been corrupted
when a function tries to return, instead of handing control to the
attacker by jumping to the attacker's code, StackGuard syslog's the
intrusion attempt and halts the program.
StackGuard is implemented as a small patch to gcc. Programs should
transparently recompile with StackGuard protection without difficulty.
This new release includes an improved StackGuard compiler with the
following enhancements:
Faster: the integrity checking procedure has been improved to
use fewer instructions.
General Random Canary Support: StackGuard now provides for both
the "Terminator" and "Random" styles of integrity checking
in both normal code and in shared libraries.
About the StackGuarded Red Hat 5.2 Linux Distribution:
We have re-compiled all of the C programs that come with a Red Hat
5.2 Linux distribution with StackGuard. The result is a system
that is generally impervious to stack smashing. We have had this
system running in production on our workstations for over two months,
with no difficulties encountered.
Previously, we built Red Hat 5.1 with an older StackGuard.
That version has been running in production for over a year without
difficulties. We have had hundreds of downloads, with no bugs found.
We have benchmarked StackGuard protection overhead using the WebStone
benchmark against a StackGuarded Apache server, and a SSH throughput
experiment through the loopback interface. In both cases, StackGuard
protection for these security-critical network services imposed no
noticable overhead.
About Immunix.org:
Immunix.org is the freeware security portal of WireX Communications,
Inc. Immunix.org will provide a variety of security enhancing
tools, and secured Linux systems. This distribution will be known as
"WireX Immunix". Presently the Immunix Linux distribution is Red
Hat 5.2 protected with StackGuard, but it will grow to include a
variety of security enhancing tools. Details are available on line
at http://immunix.org/
<warning: marketing blurb :->
About WireX Communications, Inc.: http://wirex.com/
WireX Communications, Inc. has taken on both freeware and commercial
development of Immunix technologies, including StackGuard. WireX
develops and markets a broad range of network appliance server
software for OEMs and network solution porividers. WireX products
are based on the WireX Immunix operating system. Coupled with
the WireX JDM (Java Deployment Manager), the WireX network server
appliances can support users ranging from small-businesses to
enterprise level operations with much lower administration costs
and lower total-cost-of-ownership.
(sorry about this; the legal people made me do it :-)
WireX is a registered trademark of WireX Communications, Inc.
Immunix and StackGuard are trademarks of WireX Communications, Inc.
All other marks are the property of their respective owners.
Crispin
-----
Crispin Cowan, CTO, WireX Communications, Inc. http://wirex.com
