[2448] in Kerberos
Why zero out key variables? (revisited)
daemon@ATHENA.MIT.EDU (Jim Miller)
Wed Dec 9 16:59:58 1992
From: jim@bilbo.suite.com (Jim Miller)
Date: Wed, 9 Dec 92 15:33:39 -0600
To: kerberos@MIT.EDU
Reply-To: Jim_Miller@suite.com
In a previous post I asked why Kerberos zeros out variables that hold
sensitive data. The questions I really should have asked is:
1) If these variable where not zeroed out, can other processes on the
same machine capture the contents of these variables?
Since Kerberos goes to the trouble of zeroing the variables out, I
assume the answer to the above question is YES. This brings me to my
next questions:
2) How does one process capture the contents of another process's
variables?
3) How do you protect you process from the answer(s) to Question 2?
Jim-Miller@Suite.COM
