Peter's Blog

> Apparently the next generation of processors will have hardware protection against buffer overflow attacks.

Isn't that done by simply not mixing the CPU return address and local variable data stacks?

Rob

PS: Why is the comment box only 01234567890123456789 characters wide? Reminds me of the old please write legible in the box provided joke

The hardware protection is something to do with not allowing executable code in the stack, i.e. stopping malicious code being downloaded into a buffer.

Of course there are two problems:

1) it only works if the buffer is on the stack, not if, for example, it was malloced or in a global variable. 2) it will probably break 90% of otherwise functional software so no-one will ever enable it.

Still, it looks good in the feature list.

Regarding the comment box, Dean has the same problem. It's ok for me in firefox. drupal is generating 'cols="70"' instead of 'cols="70"'. I've hacked drupal to fix it.

Peter

New features like that wouldnt help in all cases, for example, the recent WMF vulnerability didnt use a buffer overflow, it abused a part of the WMF processing that allowed the maker of the WMF to execute other code should the metafile not display properly.

Anyway, in a completley unrelated note. Followed your oneandone to debian howto. steps went ok, Just havnt rebooted and tested yet (servers currently in use by others)

After reading the following I was under the impression it was a buffer overflow:

Microsoft Windows contains a vulnerability that can allow an attacker to execute arbitrary code. The vulnerability is due to improper bounds checking in the ANIMATEPALETTE function when rendering Windows Metafile (WMF) files. Attackers can exploit the vulnerability to cause a buffer overflow by creating a carefully crafted file and enticing a victim into viewing it on an affected system.

(http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33580).

Good luck with debian, hope my article helped.

Peter

Seems there are many WMF vulnerabilities: here is another, not a buffer overflow just bad design.

Peter