Re: Security Advisory - Recent compromise of freefall.freebsd.org

>>>>> "Warner" == Warner Losh <imp@village.org> writes:

    Warner> I've not seen any of these compiler extensions recently. I     Warner> wonder what happened to them.

Someone else here mentioned gcc_with_bounds checking --- that might catch simple things like string variables that overflow.

The reason that my memory tweaked on run-time memory access checking was due to a hint in a recent announcement that use might have been made of a shell environment string overflow to break into a system. If some memory allocation tool had detected this kind of event, maybe something could have been done.

    Warner> ......... will do nothing for the race conditions, the bad
    Warner> uses of mktemp, et al, the sloppy use of seteuid(), badly
    Warner> written setuid programs, etc.

Yes, you need intelligence for these.
phillip Received on Tue Feb 18 06:19:36 1997