full-disclosure - EFC Released

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4048DE01.10805@stiller-office.com>
From: matthias at stiller-office.com (Matthias Stiller)
Subject: EFC Released

Balwinder Singh wrote:
> Dear All,
> 
> Execution Flow Control (EFC) is available for download at
> http://sourceforge.net/projects/efc/
> 
> What is EFC?
> 
> EFC monitors the execution of a program by observing system calls made
> by the program. EFC generates a database for each program describing 
> its behavioral model. The moment request for execution of a program is
> made, kernel also loads program's behavioral model into the memory.
> Each request by a program is compared with model data base, if request
> agrees with model it is permitted else program is killed. 
> 
> EFC is a kernel module, and woks on Linux only.
> 
> Sincerely
> 
> Bal
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> 

Hi Bal,

Although I appriciate ideas to enhance security concerning buffer 
overflows or format string bugs, i cannot understand why to find
the following lines in etc_db_new.c including your package:

<snip>
char pwd[MAX_PATH_LEN];
...
i = 0;
while((ch = fgetc(strace_file)) != '\0') {
   pwd[i] = ch;
   i++;
}
...
</snip>
Haven't found any made borders. And yes, due to its permissions it won't 
let people become root ... it is just a cosmetic failure. (hopefully) :)

Moreover, and that is the actual reason for replying your mail ...
I couldn't find the patch in $EFC_PATH/efc/ ... did I just download a 
non complete package?

Regards,
Matthias Stiller

-- 
http://www.inet-sec.org/~realk/