lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 15 Aug 2003 11:00:04 -0700 From: Crispin Cowan <crispin@...unix.com> To: Florian Weimer <fw@...eb.enyo.de> Subject: Re: PointGuard: It's not the Size of the Buffer, it's the Address of the Pointer Florian Weimer wrote: >Crispin Cowan <crispin@...unix.com> writes: > > >>Thanks to Snax and the Shmoo for a better tag line: It's not the Size >>of the Buffer, it's the Address of the Pointer >> >> >This is not true. There are buffer overflow exploits which do not >modify pointers, but other objects. The most prominent example is >probably the "c c c c c..." exploit for the Solaris /bin/login >vulnerability. > Please address technical commentary to the paper (which addresses this point) and not to the cute tag line. WRT this point: correct, PointGuard does not stop all buffer overflows. IMHO it *nearly* stops all shell code. To bypass PointGuard, you have to corrupt the logic of the program itself to get its own code to do what you want; you can't readily generate a jump to arbitrary code. Caveat: I can't prove the above, and someone may generate a bypass. But I don't know of one. Crispin -- Crispin Cowan, Ph.D. http://immunix.com/~crispin/ Chief Scientist, Immunix http://immunix.com http://www.immunix.com/shop/
Powered by blists - more mailing lists