[17462] in bugtraq
Re: Future of buffer overflows ?
daemon@ATHENA.MIT.EDU (Crispin Cowan)
Thu Nov 2 13:08:29 2000
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <3A010772.FD1250B2@wirex.com>
Date: Wed, 1 Nov 2000 22:19:31 -0800
Reply-To: crispin@WIREX.COM
From: Crispin Cowan <crispin@WIREX.COM>
X-To: Michal Zalewski <lcamtuf@DIONE.IDS.PL>
To: BUGTRAQ@SECURITYFOCUS.COM
Michal Zalewski wrote:
> need to execute code passed on stack. Just it is the simpliest and most
> accurate way. All techniques - libsafe, StackGuard, PaX, etc - are still
> only a workarounds, not a solutions.
I take exception to this claim. StackGuard is not a workaround: for the
vulnerabilities that StackGuard stops, it really stops them. There is not a
way to craft a different attack against the same vulnerability such that it
will bypass StackGuard.
That is not to say that StackGuard is a complete solution: there are
vulnerabilities that StackGuard does not protect against. But to beat
StackGuard, you must go find a new vulnerability: tweeking the one
StackGuard is blocking will not help.
This is distinct from both the Openwall non-excutable stack segment, and the
PAX non-executable data pages approaches. With those defenses, attacks that
are stopped by Openwall and PAX can *always* be re-worked to bypass the
Openwall and PAX defenses, *without* having to go find a new vulnerability to
exploit.
Crispin
--
Crispin Cowan, Ph.D.
Chief Research Scientist, WireX Communications, Inc. http://wirex.com
Free Hardened Linux Distribution: http://immunix.org
