bugtraq - Re: [ANNOUNCE] glibc heap protection patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6CFB176E-24FE-11D8-8B1F-000A95675F0E@cs.ucsb.edu>
Date: Tue, 2 Dec 2003 11:33:37 -0800
From: William Robertson <wkr@...ucsb.edu>
To: "Eugene Tsyrklevich" <eugene@...urityarchitects.com>
Cc: sectools@...urityfocus.com, bugtraq@...urityfocus.com,
	focus-ids@...urityfocus.com
Subject: Re: [ANNOUNCE] glibc heap protection patch


On Dec 02, 2003, at 03:27, Eugene Tsyrklevich wrote:
> With such a poor random number generator you only raise a bar slightly
> higher whereby attackers have to predict your "random" canary in their
> exploits.
>
> Also, since you initialize "__heap_magic" once per process, an attacker
> might be able to use nmap to determine the uptime of the victim machine
> which will quite precisely determine when a process was started (a 
> valid
> assumption for daemon processes).

Eugene,

Actually, I agree with you, that should be stronger.  What I think is 
even worse is the case of local heap exploits, where the attacker knows 
with some precision when the process starts.  It seems that this should 
be patched to use some source of randomness such as /dev/random instead 
of time().

Thanks!

--
William Robertson
Reliable Software Group, UC Santa Barbara
http://www.cs.ucsb.edu/~wkr/