Re: [PATCH] [SECURITY] suid procs exec'd with bad 0,1,2 fds

[Alan Cox]

> So what do you do when somebody comes up with a crack that instead of
> writing code to the stack just modifies the return address to point to
> some known point in the shared library code or something like that? 

Its actually very hard to get anything beyond a denial of service attack
via libc vectors. Its doable

> Then posts it on the cracker lists, and suddenly your precious patch does
> nothing at all for you? 

Download the contents of www.rootshell.com - try then against generic 
slackware, debian 1.x or redhat 5.0. Add the stack patch and try again

There is _one_ local only exploit available from whats basically "computer
demolition by numbers" and that was written by someone who took great
pride in having achieved it.

> The reason I don't like the patch is that it's a classic example of
> security by obscurity. It's the Windows NT approach to security, and the
> fact that Solaris does it too does not impress me in the least. 

It impresses their customer base a lot. I wouldn't consider running
a Linux based firewall without it, and I would suggest any one else planning
to use a Linux box as a firewall or exposed web server etc thinks about
using it.

Things like non executable stack are the equivalent of fitting decent
home security - they deter attacks, they stop the amateurs but if a team
of ex US navy seals decide to burgle your house - you lose. 

If you wander out of beyond the transmeta firewall into ISPland Linus you'll
find its basically all out warfare right now. www.linux.org.uk before it
was behind a ton of firewalls used to record just over 150 suspicious probes
or connections a day. Since it happened to be a Linux/m68k box I didnt have
to worry too much 8)

I'm just waiting until they crackers get a good grip on BGP4 8)

Alan