Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

Erik Corry (erik@arbat.com)
Tue, 4 Aug 1998 21:00:52 +0200


MJ wrote:
> Alan wrote:
>> Security patches aren't intended to fix bugs in software. They are a
>> recogntion of the fact that nobody has mastered the art of writing highly
>> secure software.

> Yes, but ... doesn't this look like security through obscurity? The no
> stack exec patch just makes the stack smashing attacks harder (you need
> to make use of code present somewhere else, but it's still doable), not
> impossible.

You can find cookbook exploit code on the net these days that
lets you make an exploit out of a buffer overflow in less time
than it takes Red Hat to compile a new RPM. If they had to make
use of already existing code, then that would slow down the
crackers quite a bit. They would actually have to be able to
code, not just be able to read Bugtraq.

-- 
Erik Corry

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html