Linux-kernel mailing list archive 1998-31,: Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

# Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

Erik Corry (erik@arbat.com)
Tue, 4 Aug 1998 21:00:52 +0200

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Theodore Y. Ts'o: "Re: DEVFSv50 and /dev/fb? (or /dev/fb/? ???)"
- Previous message: Gerd Knorr: "Re: video4linux problem (was problem compiling 2.1.109/112)"
- Maybe in reply to: Zachary Amsden: "[PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Next in thread: David S. Miller: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"

MJ wrote:
> Alan wrote:
>> Security patches aren't intended to fix bugs in software. They are a
>> recogntion of the fact that nobody has mastered the art of writing highly
>> secure software.

> Yes, but ... doesn't this look like security through obscurity? The no
> stack exec patch just makes the stack smashing attacks harder (you need
> to make use of code present somewhere else, but it's still doable), not
> impossible.

You can find cookbook exploit code on the net these days that
lets you make an exploit out of a buffer overflow in less time
than it takes Red Hat to compile a new RPM. If they had to make
use of already existing code, then that would slow down the
crackers quite a bit. They would actually have to be able to
code, not just be able to read Bugtraq.

    --
    Erik Corry

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

- Next message: Theodore Y. Ts'o: "Re: DEVFSv50 and /dev/fb? (or /dev/fb/? ???)"
- Previous message: Gerd Knorr: "Re: video4linux problem (was problem compiling 2.1.109/112)"
- Maybe in reply to: Zachary Amsden: "[PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"
- Next in thread: David S. Miller: "Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds"