On Thu, Oct 14, 2004 at 04:20:02PM +0300, Balint Cristian wrote: > Hi 1 > Acording to PIE randomization and to the fact that in FC1/FC2 > especialy > upcoming FC3 have all network daemons builded with PIE > and .... .... > still need an strong advice that PIE+selinux can bring an unexploitable > system without requiring updates or track security list for posible > vulnerabilities in time. The Position Independent Executable (PIE) stuff presents a moderately strong deterrent to buffer overflow exploits. It does not address other security flaws. http://www.redhat.com/f/pdf/rhel/WHP0006US_Execshield.pdf Buffer overflow bugs have two problems that matter to a system. Execution of foreign bits and denial of service (core dump/ exit). The common use of PIE tricks will stop or limit the execution of foreign bits but may not eliminate the denial of service component of an attack. Any complex system should expect to need updates. PIE+selinux should contain and limit the impact of attacks. Day one, yea hour zero attacks are possible now so all a prudent man can expect is that we we will continue to have sufficient time to fix what needs to be fixed. Any plan should expect updates. The smaller the set of services the smaller the risk. -- T o m M i t c h e l l May your cup runneth over with goodness and mercy and may your buffers never overflow.
