lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: matthias at stiller-office.com (Matthias Stiller)
Subject: EFC Released

Balwinder Singh wrote:
> Dear All,
> 
> Execution Flow Control (EFC) is available for download at
> http://sourceforge.net/projects/efc/
> 
> What is EFC?
> 
> EFC monitors the execution of a program by observing system calls made
> by the program. EFC generates a database for each program describing 
> its behavioral model. The moment request for execution of a program is
> made, kernel also loads program's behavioral model into the memory.
> Each request by a program is compared with model data base, if request
> agrees with model it is permitted else program is killed. 
> 
> EFC is a kernel module, and woks on Linux only.
> 
> Sincerely
> 
> Bal
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> 

Hi Bal,

Although I appriciate ideas to enhance security concerning buffer 
overflows or format string bugs, i cannot understand why to find
the following lines in etc_db_new.c including your package:

<snip>
char pwd[MAX_PATH_LEN];
...
i = 0;
while((ch = fgetc(strace_file)) != '\0') {
   pwd[i] = ch;
   i++;
}
...
</snip>
Haven't found any made borders. And yes, due to its permissions it won't 
let people become root ... it is just a cosmetic failure. (hopefully) :)

Moreover, and that is the actual reason for replying your mail ...
I couldn't find the patch in $EFC_PATH/efc/ ... did I just download a 
non complete package?

Regards,
Matthias Stiller

-- 
http://www.inet-sec.org/~realk/


Powered by blists - more mailing lists