bugtraq - Re: PointGuard: It's not the Size of the Buffer, it's the Address of the Pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3F3D1FA4.2060601@immunix.com>
Date: Fri, 15 Aug 2003 11:00:04 -0700
From: Crispin Cowan <crispin@...unix.com>
To: Florian Weimer <fw@...eb.enyo.de>
Subject: Re: PointGuard: It's not the Size of the Buffer, it's the Address
 of the Pointer


Florian Weimer wrote:

>Crispin Cowan <crispin@...unix.com> writes:
>  
>
>>Thanks to Snax and the Shmoo for a better tag line: It's not the Size
>>of the Buffer, it's the Address of the Pointer
>>    
>>
>This is not true.  There are buffer overflow exploits which do not
>modify pointers, but other objects.  The most prominent example is
>probably the "c c c c c..." exploit for the Solaris /bin/login
>vulnerability.
>
Please address technical commentary to the paper (which addresses this 
point) and not to the cute tag line.

WRT this point: correct, PointGuard does not stop all buffer overflows. 
IMHO it *nearly* stops all shell code. To bypass PointGuard, you have to 
corrupt the logic of the program itself to get its own code to do what 
you want; you can't readily generate a jump to arbitrary code.

Caveat: I can't prove the above, and someone may generate a bypass. But 
I don't know of one.

Crispin

-- 
Crispin Cowan, Ph.D.           http://immunix.com/~crispin/
Chief Scientist, Immunix       http://immunix.com
            http://www.immunix.com/shop/