Re: [Announcement] "Exec Shield", new Linux security feature

[Ingo Molnar]

On 4 May 2003, Andi Kleen wrote:

> Ingo Molnar <[e-mail]> writes:
> 
> > ie. if the binary anywhere has code that does:
> > 
> > 	system("/bin/sh")
> 
> You just need system(char *arg) { ... } (= in every libc). Then put
> /bin/sh somewhere and a pointer to it on the stack as argument and
> overwrite some return address on the stack to jump to it.

well, how do you put the pointer on the stack if your only way to get into
the ASCII-area is to stop the overflow early and use the final \0 ? [and
the parameter has to be put _after_ the enclosing \0. ] It's not 100%
impossible, but in the common case looks quite unlikely.

	Ingo