Re: Buffer Over-runs, was Open source firewalls

From: Brian O'Mahoney (omb_at_khandalf.com)
Date: 07/15/05

  • Next message: Andi Kleen: "Re: [announce] linux kernel performance project launch at sourceforge.net" 
    Date:	Fri, 15 Jul 2005 00:53:33 +0200
To: rvk@prodmail.net, linux-kernel@vger.kernel.org

    First there are endless ways of stopping DAMAGE from buffer
    over-runs, from code that accepts user data, eg extend buffer, dont
    use dangerous strxxx functions .... so while you can move
    stuff to proxies, and that has been done extensively e.g.
    for sendmail it is a cop-out, far better fix the application;

    Next, while all buffer over runs are very bad it is only those
    that stamp on the stack, overwriting the return address stored
    there and implanting viral code to be executed, that are truely
    __EVIL__.

    To do that you need to know a lot of things, the architecture
    ie executing x86 code on a ppc will get you no-where, you must
    know, and be able to debug your mal-ware against a stable
    target, and this is why the _VERY_ slowly patched Windoze is
    so vulnerable, and finally you really need to know the stack
    base, top of stack, normally growing downward, and ... be able
    to actually run code out of the stack space;

    and if any one of these conditions are not true, eg I compiled
    sendmail with a newer GCC, stack is not executable, ...

    the exploit just fails or crashes an app and then you go after
    why?

    but your system is not compromised.

    One final point, in practice, you get lots of unwanted packets
    off the internet, and in general you do not want them on your
    internal net, both for performance and security reasons, if you
    drop them on your router or firewall then you dont need to
    worry if the remote app is mal-ware. 

    -- 
mit freundlichen Grüßen, Brian.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/
  • Next message: Andi Kleen: "Re: [announce] linux kernel performance project launch at sourceforge.net"

    Relevant Pages

    • Re: Buffer overrun exploit example
      ... > What is the idea behind a 'buffer overflow exploit' in general. ... > mess with the stack so it will jump back to another location which is ... Disregarding the "overflow" part for a moment, ... injecting hostile code and setting up the CPU for executing it can ...
      (alt.comp.lang.borland-delphi)
    • [NEWS] How to Remotely and Automatically Exploit a Format Bug
      ... Exploiting a format bug remotely is not as difficult as one would think. ... We will use very minimalist server along this paper. ... Since the buffer is directly available to a malicious user, ... Guessing the address of the shellcode in the stack ...
      (Securiteam)
    • [NEWS] Multiple ValiCert Security Problems
      ... * Enterprise VA Host Server for processing validation requests VA API ... Multiple buffer overflows exist in the CGI script, forms.exe, which is ... Analysis of the code and stack contents reveals that the unchecked buffer ...
      (Securiteam)
    • [REVS] Buffer Overflow Exploitation and Prevention
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... you have to know what a buffer overflow is (we highly recommend reading ... to by `str' is too long, we smash, outside of the buffer, EBP (not always ... We'll have to appropriately prepare the stack in order for our ...
      (Securiteam)
    • [REVS] Writing Buffer Overflow Exploits - a Tutorial for Beginners
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Buffer overflows in user input dependent buffers have become one of the ... The bottom of the stack ... To keep it simple, shellcode is simply assembler commands, which we write ...
      (Securiteam)