[31221] in bugtraq
Re: PointGuard: It's not the Size of the Buffer, it's the Address
daemon@ATHENA.MIT.EDU (Crispin Cowan)
Fri Aug 15 15:56:58 2003
Message-ID: <3F3D1FA4.2060601@immunix.com>
Date: Fri, 15 Aug 2003 11:00:04 -0700
From: Crispin Cowan <crispin@immunix.com>
MIME-Version: 1.0
To: Florian Weimer <fw@deneb.enyo.de>
In-Reply-To: <87smo3yr1t.fsf@deneb.enyo.de>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Florian Weimer wrote:
>Crispin Cowan <crispin@immunix.com> writes:
>
>
>>Thanks to Snax and the Shmoo for a better tag line: It's not the Size
>>of the Buffer, it's the Address of the Pointer
>>
>>
>This is not true. There are buffer overflow exploits which do not
>modify pointers, but other objects. The most prominent example is
>probably the "c c c c c..." exploit for the Solaris /bin/login
>vulnerability.
>
Please address technical commentary to the paper (which addresses this
point) and not to the cute tag line.
WRT this point: correct, PointGuard does not stop all buffer overflows.
IMHO it *nearly* stops all shell code. To bypass PointGuard, you have to
corrupt the logic of the program itself to get its own code to do what
you want; you can't readily generate a jump to arbitrary code.
Caveat: I can't prove the above, and someone may generate a bypass. But
I don't know of one.
Crispin
--
Crispin Cowan, Ph.D. http://immunix.com/~crispin/
Chief Scientist, Immunix http://immunix.com
http://www.immunix.com/shop/
