Home page logo

bugtraq logo Bugtraq mailing list archives

Re: Future of buffer overflows ?
From: Crispin Cowan <crispin () WIREX COM>
Date: Wed, 1 Nov 2000 22:19:31 -0800

Michal Zalewski wrote:

need to execute code passed on stack. Just it is the simpliest and most
accurate way. All techniques - libsafe, StackGuard, PaX, etc - are still
only a workarounds, not a solutions.

I take exception to this claim.  StackGuard is not a workaround:  for the
vulnerabilities that StackGuard stops, it really stops them.  There is not a
way to craft a different attack against the same vulnerability such that it
will bypass StackGuard.

That is not to say that StackGuard is a complete solution:  there are
vulnerabilities that StackGuard does not protect against.  But to beat
StackGuard, you must go find a new vulnerability:  tweeking the one
StackGuard is blocking will not help.

This is distinct from both the Openwall non-excutable stack segment, and the
PAX non-executable data pages approaches.  With those defenses, attacks that
are stopped by Openwall and PAX can *always* be re-worked to bypass the
Openwall and PAX defenses, *without* having to go find a new vulnerability to


Crispin Cowan, Ph.D.
Chief Research Scientist, WireX Communications, Inc. http://wirex.com
Free Hardened Linux Distribution:                    http://immunix.org

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]