full-disclosure - Execution Flow Control (EFC)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030816200135.GC3751@spoofed.org>
From: warchild at spoofed.org (Jon Hart)
Subject: Execution Flow Control (EFC)

On Sat, Aug 16, 2003 at 07:13:50AM -0500, Shanphen Dawa wrote:
> This was posted to bugtraq.
> 
> http://www.securityfocus.com/archive/1/333451/2003-08-13/2003-08-19/0
> 
> The author of the software claims any machine running this
> Execution Flow Control (EFC) program is 100%. I think 100% is a tad
> bit arrogant, and I can't wait till he has to eat his words. The
> website is a tad under the professional type websites I would take
> seriously, but I thought this might spark a good discussion, and get
> us off that bl*st*r w*rm.
> 
> http://203.197.88.14/
> http://203.197.88.14/efc

This line from http://203.197.88.14/efc/efc_intro.php really caught my
eye:

 PROS AND CONS OF EFC.

    1. Can protect against known or unknown vulnerabilities.

Ok, with that in mind, lets see how well it stands up to "unknown"
attacks...

I'm not one to judge product quality based (partially or otherwise) on
past or current programming mistakes, but if I was, I'd say that
something like:

for(i=0;arg[i]; i++) {
	if ((strncmp(arg[i], "/etc/shadow",11) == 0) ||
		(strncmp(arg[i], "shadow",6) == 0)) {
			write(1,"arg cannot be shadow\n", 21);
			return 0;
	}
}

is a pretty poor way of making sure people don't play with your shadow
file.  There are many possibilities here, but the bottom line is that
the webserver had a poorly written CGI application and EFC didn't seem
to do much in the way of stopping someone from exploiting it and
stealing the shadow file.  

fwiw,

-jon