full-disclosure - Coming soon: CPU fix for buffer overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: hybriz at rego-security.com (hybriz)
Subject: Coming soon: CPU fix for buffer overflows

>
>Subject: RE: [Full-Disclosure] Coming soon: CPU fix for buffer overflows
>   From: "Richard M. Smith" <rms@...puterbytesman.com>
>   Date: Mon, 23 Feb 2004 15:39:10 -0500
>     To: <hybriz@...o-security.com>
>
>Let's get to the bottom line.  Would this page execution bit scheme stop
>stuff like the Blaster worm?
>
>Richard 

IMHO,
if the page-wise non-exec stack was implemented in win2k>= during the
blaster period the blaster worm as we know it obviously would not exist.
thing is, the timeline substitute would use diferent exploiting techniq
to have the same effect. non-exec stack doesnt stop ALL buffer overflow
attacks/techniqs, win2k+3 has a stack protection and it has been proven
to be bypassable. The blaster worm wouldnt exist as we know it, an
analogous substitute would.

the execution bit exists on other archs but it doesnt mean that
exploitation of stack based overflows isnt possible, it's just slightly
(IMHO) more difficult and there are less possible attack vectors
(for example, the ret-into-libc techniq will fail if the binary is
stacticly linked).

btw, in my country brought better 'security' to overall networks and home
users since many started using pseudo-well configured by default firewalls
and in a way that wouldnt happen if the stupid worm didnt have broken
shellcode and 'non-universal' offsets.

regards,
hybriz

--