[32648] in bugtraq
Re: [ANNOUNCE] glibc heap protection patch
daemon@ATHENA.MIT.EDU (William Robertson)
Tue Dec 2 15:52:40 2003
In-Reply-To: <1448101133295651070364472@securityarchitects.com>
Mime-Version: 1.0 (Apple Message framework v606)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <6CFB176E-24FE-11D8-8B1F-000A95675F0E@cs.ucsb.edu>
Content-Transfer-Encoding: 7bit
Cc: sectools@securityfocus.com, bugtraq@securityfocus.com,
focus-ids@securityfocus.com
From: William Robertson <wkr@cs.ucsb.edu>
Date: Tue, 2 Dec 2003 11:33:37 -0800
To: "Eugene Tsyrklevich" <eugene@securityarchitects.com>
On Dec 02, 2003, at 03:27, Eugene Tsyrklevich wrote:
> With such a poor random number generator you only raise a bar slightly
> higher whereby attackers have to predict your "random" canary in their
> exploits.
>
> Also, since you initialize "__heap_magic" once per process, an attacker
> might be able to use nmap to determine the uptime of the victim machine
> which will quite precisely determine when a process was started (a
> valid
> assumption for daemon processes).
Eugene,
Actually, I agree with you, that should be stronger. What I think is
even worse is the case of local heap exploits, where the attacker knows
with some precision when the process starts. It seems that this should
be patched to use some source of randomness such as /dev/random instead
of time().
Thanks!
--
William Robertson
Reliable Software Group, UC Santa Barbara
http://www.cs.ucsb.edu/~wkr/
