bugtraq - Re: Buffer overflow prevention

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 14 Aug 2003 14:12:12 -0500
From: Patrick Dolan <dolan@...admin.unt.edu>
To: "Brian Glover" <brian@...turionservice.com>
Subject: Re: Buffer overflow prevention


You're right, I didn't do any research to back up that claim.  I just assumed 
it was included since Gentoo had it but in fact they just include the patch.
As previously mentioned, you can get it here if you're interested:
http://www.trl.ibm.com/projects/security/ssp/

And as also mentioned before, Grsecurity complements this protection well to 
build a very secure server environment.  I highly recommend it.


On Thursday 14 August 2003 01:36 pm, you wrote:
> On RedHat 9, gcc version 3.2.2 20030222, it is not included.
>
> [brian@...hingMachine brian]$ gcc -fstack-protector -o testfile
> testfile.c
> cc1: unrecognized option `-fstack-protector'
>
> -----Original Message-----
> From: Patrick Dolan [mailto:dolan@...admin.unt.edu]
> Sent: Wednesday, August 13, 2003 6:31 PM
> To: Lance James
> Subject: Re: Buffer overflow prevention
>
>
> Yes, it should be in all distributions of GCC.  I use it on a Gentoo
> Linux server of mine.  The version is 3.2.3, just FYI.
>
> ----- Original Message -----
> From: "Lance James" <lance.james@...bone.com>
> To: <dolan@...admin.unt.edu>; "'Eygene A. Ryabinkin'"
> <rea@....mbslab.kiae.ru>
> Cc: <bugtraq@...urityfocus.com>
> Sent: Wednesday, August 13, 2003 6:21 PM
> Subject: RE: Buffer overflow prevention
>
> > Is that in universal gcc, or OpenBSD only?
> >
> > Lance James
> >
> > -----Original Message-----
> > From: Patrick Dolan [mailto:dolan@...admin.unt.edu]
> > Sent: Wednesday, August 13, 2003 10:20 AM
> > To: Eygene A. Ryabinkin
> > Subject: Re: Buffer overflow prevention
> >
> > There is a flag for the Gnu C/C++ compilers, -fstack-protector, that
> > will implement ProPolice stack protection.  It should prevent stack
> > smashing techniques.
> >


-- 
Patrick Dolan
UNT Information Security

PGP ID: E5571154
Primary key fingerprint: 5681 25E4 6BE6 298E 9CF0  6F8D B13B 2456 E557 1154