Bugtraq mailing list archives
Re: fixing all buffer overflows --- random magin numbers
From: dulitz () VALLEYTECH COM (Daniel W. Dulitz x108)
Date: Mon, 13 Sep 1999 13:07:12 -0400
Eric Hutchinson writes:
On Sat, 11 Sep 1999, Dr. Joel M. Hoffman wrote:In particular, I was thinking that part of building a kernel would involve assigning a random number to each syscall, and creating a syscall.h file with these random numbers. [...]
Another way of saying this is to make the syscalls into capabilities (in the traditional sense, not in the Linux sense). If the space of system call numbers were large relative to the number of actual system calls, it would not be feasible to search using brute force. Especially since the kernel could kill the process and sound an alarm if a nonexistent syscall were attempted.
ok what happens when you need to compile soemthing else? [...]
Well, you link against libc like you always do -- don't need syscall.h for that. Oops. :-) Protecting libc is a lot harder than protecting syscall.h. An little disassembly of libc would tell you most everything you needed to know, and dynamically linking against libc requires that you can read it.... So it won't stop - attacks that call library entry points directly, - attacks by people who can get read access to libc (either in a shared library or in core), - data-directed attacks, where the program flow is unchanged but the data is changed, and of course, - attacks on higher-level scripting languages (like shell metacharacter parsing). Not to mention some other things I've forgotten. But it would get script kiddies out of nearly all the binary-code remote exploit business. Best, daniel dulitz
Current thread:
- Re: Root shell vixie cron exploit, (continued)
- Re: Root shell vixie cron exploit Peter Wemm (Sep 07)
- Re: Root shell vixie cron exploit Raymond Dijkxhoorn (Sep 07)
- Re: Root shell vixie cron exploit Christos Zoulas (Sep 03)
- [security-officer () FreeBSD ORG: FreeBSD-SA-99:01: BSD File Flags and Programming Techniques] Patrick Oonk (Sep 03)
- Re: Root shell vixie cron exploit Valentin Nechayev (Sep 04)
- gftp Oscar Haeger (Sep 05)
- Re: gftp - ms ftp debug mode Bencsath Boldizsar (Sep 08)
- fixing all buffer overflows --- random magin numbers Dr. Joel M. Hoffman (Sep 11)
- Re: fixing all buffer overflows --- random magin numbers Peter van Dijk (Sep 12)
- Re: fixing all buffer overflows --- random magin numbers Eric Hutchinson (Sep 12)
- Re: fixing all buffer overflows --- random magin numbers Daniel W. Dulitz x108 (Sep 13)
- Enterprise Overflow Daniel Kerr (Sep 11)
- Re: gftp - ms ftp debug mode Valentin (Sep 12)
- Re: gftp - ms ftp debug mode Max Vision (Sep 12)
- Linux 2.2.12 mini-audit Solar Designer (Sep 13)
- Vulnerability in dtaction Job de Haas (Sep 13)
- Many kind of POP3/SMTP server softwares for Windows have buffer overflow bug UNYUN (Sep 12)
- Accept overflow on Netscape Enterprise Server 3.6 SP2 Nobuo Miwa (Sep 12)
- Re: COM and Windows 2000 thomasz () HOSTMASTER ORG (Sep 12)