bugtraq - Re: PointGuard: It's not the Size of the Buffer, it's the Address of the Pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87smo3yr1t.fsf@deneb.enyo.de>
Date: Fri, 15 Aug 2003 15:43:42 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: bugtraq@...urityfocus.com
Subject: Re: PointGuard: It's not the Size of the Buffer, it's the Address
 of the Pointer

Crispin Cowan <crispin@...unix.com> writes:

> Thanks to Snax and the Shmoo for a better tag line: It's not the Size
> of the Buffer, it's the Address of the Pointer

This is not true.  There are buffer overflow exploits which do not
modify pointers, but other objects.  The most prominent example is
probably the "c c c c c..." exploit for the Solaris /bin/login
vulnerability.