Re: Buffer Over-runs, was Open source firewalls

["Brian O'Mahoney" <omb@khandalf.com>]

First there are endless ways of stopping DAMAGE from buffer
over-runs, from code that accepts user data, eg extend buffer, dont
use dangerous strxxx functions .... so while you can move
stuff to proxies, and that has been done extensively e.g.
for sendmail it is a cop-out, far better fix the application;

Next, while all buffer over runs are very bad it is only those
that stamp on the stack, overwriting the return address stored
there and implanting viral code to be executed, that are truely
__EVIL__.

To do that you need to know a lot of things, the architecture
ie executing x86 code on a ppc will get you no-where, you must
know, and be able to debug your mal-ware against a stable
target, and this is why the _VERY_ slowly patched Windoze is
so vulnerable, and finally you really need to know the stack
base, top of stack, normally growing downward, and ... be able
to actually run code out of the stack space;

and if any one of these conditions are not true, eg I compiled
sendmail with a newer GCC, stack is not executable, ...

the exploit just fails or crashes an app and then you go after
why?

but your system is not compromised.

One final point, in practice, you get lots of unwanted packets
off the internet, and in general you do not want them on your
internal net, both for performance and security reasons, if you
drop them on your router or firewall then you dont need to
worry if the remote app is mal-ware.

-- 
mit freundlichen Grüßen, Brian.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/