[31185] in bugtraq
Re: Buffer overflow prevention
daemon@ATHENA.MIT.EDU (Jedi/Sector One)
Thu Aug 14 16:53:29 2003
Date: Thu, 14 Aug 2003 22:15:03 +0200
From: Jedi/Sector One <j@pureftpd.org>
To: Timo Sirainen <tss@iki.fi>
Message-ID: <20030814201525.GA21538@c9x.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <F289F033-CE8B-11D7-B43D-000393CC2E90@iki.fi>
On Thu, Aug 14, 2003 at 10:17:29PM +0300, Timo Sirainen wrote:
> AFAIK all those combined do bring real security against generic exploits.
"Real security" is not the word.
PaX / Propolice / W^X / non-exec stacks don't solve bugs. What they do is
to _abort_ execution of a process when it behaves abnormally.
So instead of giving attackers the opportunity to run arbitrary code, you
only give them the ability to cause a denial of service.
This kind of protection should be coupled with tools that automatically
restart daemons when they crash (ex: daemontools and monit) to actually keep
the service running when under attack. Still, all of this is a couple of
unreliable band-aids.
--
__ /*- Frank DENIS (Jedi/Sector One) <j@42-Networks.Com> -*\ __
\ '/ <a href="http://www.PureFTPd.Org/"> Secure FTP Server </a> \' /
\/ <a href="http://www.Jedi.Claranet.Fr/"> Misc. free software </a> \/
