Re: securing bind

[Crispin Cowan <crispin () cse ogi edu>]

Ken Hardy wrote:

> It's obvious that we'll never see the end of stack overrun
> attacks until overrunning the stack doesn't get you anywhere.
> IMHO something like StackGuard should be a standard option on
> *all* compilers, and all exposed services like DNS should be
> compiled with it enabled.  Make that every bit of code (incl.
> kernel?) running on a firewall.

Thanks!


> See http://www.cse.ogi.edu/DISC/projects/immunix/StackGuard.

StackGuard has moved to http://immunix.org


> I'd be interested in knowlegeable comments about how reliable
> and comprehensive this approach to the stack overrun problem
> is, though it's probably beyond the charter of this list.

We feel that it is very reliable.  Comprehensiveness is pretty good, but
decreasing.  There is an increasing trend towards buffer overflow attacks that
corrupt program state other than activation records.  We're working on an
advanced version of StackGuard called "PointGuard" that will offer more
comprehensive protection.


> Alternatively (and higher performance?) Solaris 2 has a kernel
> parameter that can be set to make the stack non-executable.

As does Linux.  I've just finished writing a paper describing the comparative
effectiveness of a variety of buffer overflow defenses.  Notably, non-executable
stack overlaps with StackGuard, but each has attacks that it uniquely defends
against.  Since they are compatible, both should be used for maximum coverage.
The paper will appear at the DARPA Information Survivability Expo (
http://schafercorp-ballston.com/discex/ ) and an invited talk at SANS 2000 (
http://www.sans.org/newlook/events/sans2000.htm ).  I'll have the paper up on
the publications page at http://immunix.org shortly.


> The documentation I've seen warns that some programs depend on
> self-modifying code on the stack but says that that may not be
> an issue for many limited-use dedicated servers.  Anyone try
> this when running any popular firewall products???

Self-modifying code is a problem for the non-executable stack, but not for
StackGuard.  I've never seen that as a practical problem for either technology,
and I've been running both on my personal laptop/workstation for 16 months.

Crispin
-----
Crispin Cowan, CTO, WireX Communications, Inc.    http://wirex.com
Free Hardened Linux Distribution:                 http://immunix.org