Home page logo

bugtraq logo Bugtraq mailing list archives

Re: Buffer overflow prevention
From: Peter Busser <peter () trusteddebian org>
Date: Fri, 15 Aug 2003 11:54:54 +0200


AFAIK all those combined do bring real security against generic exploits.
  "Real security" is not the word.

Even though PaX is better than W^X, it is far from being perfect.

  PaX / Propolice / W^X / non-exec stacks don't solve bugs. What they do is
to _abort_ execution of a process when it behaves abnormally.
  So instead of giving attackers the opportunity to run arbitrary code, you
only give them the ability to cause a denial of service.

You could say they trade availability for integrity.

  This kind of protection should be coupled with tools that automatically
restart daemons when they crash (ex: daemontools and monit) to actually keep
the service running when under attack. Still, all of this is a couple of
unreliable band-aids.

A better way to deal with would be to automatically warn someone with enough
information to easily find and fix the problem. Restarting the daemon makes the
problem managable, but it won't solve the bug.

Peter Busser
The Adamantix Project
Taking trustworthy software out of the labs, and into the real world

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]