Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Bugtraq: Re: Solaris 7 x86 lpset exploit.

Re: Solaris 7 x86 lpset exploit.

From: Casper Dik <Casper.Dik_at_HOLLAND.SUN.COM>
Date: Mon, 1 May 2000 10:10:30 +0200

>>> set noexec_user_stack = 1
>
>> [...], there is a reason, why SUN does enable stack execution by
>> default, if i am correctly informed this is due to some fortran or
>> rare/old compiler issue, and might break some fortran or other alien
>> language code...
>
>It'll also break gcc's nested function support, since it's implemented
>with stack trampolines. (It doesn't *have* to be; in principle
>function pointers could be widened to carry the same information. But
>doing that would break function-pointer compatability with code
>compiled with other compilers...not to mention meaning that most
>function pointers would carry a bunch of unnecessary-for-them extra
>data around. Another possible way around it would be to cause gcc to
>keep part of the stack in the data segment, out of what the kernel
>thinks of as the stack, and have it do its trampolines there. This
>runs into big problems with setjmp and other nonlocal exits, and
>possibly with signal handlers as well.)

It's wrong to say it affects all nested functions; it only affects
nested functions passed as parameter.

In current gcc releases this has been fixed. The trampoline code
now calls "mprotect()" after putting a trampoline on the stack.

Casper
Received on May 02 2000

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos