Re: Stack Smashing and no-exec

Kragen (kragen@pobox.com)
Fri, 7 Aug 1998 11:44:14 -0400 (EDT)

On 7 Aug 1998, H. Peter Anvin wrote:
> No it cannot (unless there is a kernel bug, of course.) The problem
> occurs with poorly written setuid programs or as-root-running daemons,
> where an unprivileged user manages to inject data that somehow causes
> the privileged program to take an unauthorized action.

You say "poorly written". The trouble is, essentially all setuid
programs or as-root-running daemons are poorly-written enough to have
buffer-overflows in them. The only one I know about that hasn't had
them yet is qmail-lspawn.

Kragen

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html