mivel ugyis uj kernelt kellett forditanom ( http://portal.fsn.hu/modules.php?name=News…rder=0&thold=-1 ) gondoltam kiprobalom az exec-shield patchet ( http://people.redhat.com/mingo/exec-shield/ );

a patch celja szeleskoru vedelmet nyujtani a memoria manipulacoval probalkozo exploitok ellen; hasznalat (a pax-szal ellentetben) nem igenyli kritikus binarisok patcheleset (pontosabban az xnek kell egy valtoztatas a /proc-ban, de a disztrok nagy reszehez mar elkezdtek az exec-shield kompatibilis x feltolteset);

kicsit tobb info: https://portal.fsn.hu/modules.php?name=Sear…ries&category=0

minden kiprobalt program futott nalam: ut2003, java, mplayer, wine, stb;

es amit nyujt:

$ cat /proc/version
Linux version 2.4.23-exec-shield (root@cecil) (gcc version 3.3.2 (Debian)) #1 2003. dec. 3., szerda, 18.08.00 CET

$ cat /proc/sys/kernel/exec-shield
2

libsafe-2.0-16:
./canary-exploit
This program tries to use printf(„%n”) to overwrite the
return address on the stack.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue…
Szegmens hiba

./exploit-non-exec-stack
This program demonstrates how a (stack) buffer overflow
can attack linux kernels with *non-executable* stacks.
This is variation on return-int-libc attack.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue…
Szegmens hiba

./t1
This program tries to use strcpy() to overflow the buffer.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue…
Szegmens hiba

./t1w
This program tries to use strcpy() to overflow the buffer.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue…
Szegmens hiba

./t3
This program will exec() a new program. The new program will
overflow the buffer using strcpy().
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue…
Szegmens hiba

./t3w
This program will exec() a new program. The new program will
overflow the buffer using strcpy().
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue…
Szegmens hiba

./t4
This program will fork() child process, and the child
will overflow the buffer using strcpy().
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue…
parent process terminating

./t4w
This program will fork() child process, and the child
will overflow the buffer using strcpy().
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue…
parent process terminating

./t5
This program tries to use strcat() to overflow the buffer.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue…
Szegmens hiba

./t6
This program tries to use scanf() to overflow the buffer.
If you get a /bin/sh prompt, then the exploit has worked.
Press any key to continue…
Szegmens hiba

tehat aki eddig hasznalta a libsafet, annak ez a patch jelenleteben nincs kulonosebb szuksege ra;

paxtest-0.9.3:
./paxtest
PaXtest – Copyright© 2003 by Peter Busser
Released under the GNU Public Licence version 2 or later

It may take a while for the tests to complete
Test results:
PaXtest – Copyright© 2003 by Peter Busser
Released under the GNU Public Licence version 2 or later

Executable anonymous mapping : Killed
Executable bss : Killed
Executable data : Killed
Executable heap : Killed
Executable stack : Killed
Executable anonymous mapping (mprotect) : Killed
Executable bss (mprotect) : Vulnerable
Executable data (mprotect) : Vulnerable
Executable heap (mprotect) : Vulnerable
Executable shared library bss (mprotect) : Vulnerable
Executable shared library data (mprotect): Vulnerable
Executable stack (mprotect) : Vulnerable
Anonymous mapping randomisation test : 8 bits (guessed)
Heap randomisation test (ET_EXEC) : 14 bits (guessed)
Heap randomisation test (ET_DYN) : 13 bits (guessed)
Main executable randomisation (ET_EXEC) : No randomisation
Main executable randomisation (ET_DYN) : 12 bits (guessed)
Shared library randomisation test : 12 bits (guessed)
Stack randomisation test (SEGMEXEC) : 17 bits (guessed)
Stack randomisation test (PAGEEXEC) : 17 bits (guessed)
Return to function (strcpy) : Vulnerable
Return to function (memcpy) : Executable shared library bss
Executable shared library data : Killed
Writable text segments : Vulnerable

tehat a paxot meg nem tudna felvaltani, de az eredmeny nem rossz;

mindenkinek tudom ajanlani ezt a patchet, aki sajat kernelt hasznal;
telepites, beallitas: http://people.redhat.com/mingo/exec-shield…NCE-exec-shield