lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4048DE01.10805@stiller-office.com> From: matthias at stiller-office.com (Matthias Stiller) Subject: EFC Released Balwinder Singh wrote: > Dear All, > > Execution Flow Control (EFC) is available for download at > http://sourceforge.net/projects/efc/ > > What is EFC? > > EFC monitors the execution of a program by observing system calls made > by the program. EFC generates a database for each program describing > its behavioral model. The moment request for execution of a program is > made, kernel also loads program's behavioral model into the memory. > Each request by a program is compared with model data base, if request > agrees with model it is permitted else program is killed. > > EFC is a kernel module, and woks on Linux only. > > Sincerely > > Bal > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html > > Hi Bal, Although I appriciate ideas to enhance security concerning buffer overflows or format string bugs, i cannot understand why to find the following lines in etc_db_new.c including your package: <snip> char pwd[MAX_PATH_LEN]; ... i = 0; while((ch = fgetc(strace_file)) != '\0') { pwd[i] = ch; i++; } ... </snip> Haven't found any made borders. And yes, due to its permissions it won't let people become root ... it is just a cosmetic failure. (hopefully) :) Moreover, and that is the actual reason for replying your mail ... I couldn't find the patch in $EFC_PATH/efc/ ... did I just download a non complete package? Regards, Matthias Stiller -- http://www.inet-sec.org/~realk/
Powered by blists - more mailing lists