bugtraq - Re: Is DEP easily evadable?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87fz15prjy.fsf@deneb.enyo.de>
Date: Thu, 13 Jan 2005 11:11:13 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: John Richard Moser <nigelenki@...cast.net>
Cc: bugtraq@...urityfocus.com
Subject: Re: Is DEP easily evadable?

* John Richard Moser:

> I'm no security expert, so bear with me here; I just kind of tripped
> over something interesting that I'd like to ask about.
>
> I was blogging about DEP based on MS' technical documentation and came
> up with a quick and dirty way to use a buffer overflow (we'll assume no
> stackguarding, or that you found a way around it i.e. using a format
> string bug) to kick DEP out of the way.  This is pretty much based on
> the PaX documentation and justification for mprotect() restrictions.

Look for return-into-libc exploits.  There are quite a few.

Even with non-executable stack and heap, no one guarantees that buffer
overflows aren't exploitable.  Randomization of load addresses is
intended to provide additional protection, but the number of available
bits is fairly low on 32 bit machines (problably less than 16).  I
don't know if Windows is doing it.