Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: [Full-disclosure] 18th anniversary of Internet worma.k.a.Morris worm
From: Dave \ (davek_throwawayhotmail.com)
Date: Mon Nov 13 2006 - 15:16:30 CST
> On Sun, 12 Nov 2006 18:21:16 GMT, "Dave \"No, not that one\" Korn" said:
> > Georgi Guninski wrote:
> > > my question was:
> > >
> > > when was the first provable *public* (as in common sense)
> > > announcement of the exploitability of buffer overflows.
> > The use of smashing the stack to seize control of the program flow was
> > in
> > everyday usage on the Commodore PET from around 1979-1980ish. It was
> > our
> > standard technique for making programs autorun after loading!
> Was that a "classic" smash-the-stack, where an overly long paramater is
> to over-write the return pointer, or were you guys just intercepting the
> return pointer directly?
Well, it wasn't a parameter, but it was overwriting the return pointer.
Everything lived at absolute addresses on that machine, there being no
dynamic allocation or memory management. The stack lived a short distance
in memory below the area reserved for program code. By setting the
(absolute) load address of your program a couple of pages lower than usual,
the first thing that got loaded was your stack, then your program area, so
you could overwrite the stack with an address in the code region and as soon
as the kernel's tape load routine returned you seized control.
> If the latter, I'm pretty sure there was software
> that would overlay return pointers in order to redirect program flow as
> back as IBM's OS/360 in the 1967-75 timeframe.
Indeed, and there's also the age-old technique of implementing a computed
goto by pushing the address on the stack and executing a ret (rts for you
old 6502 heads out there) instruction.
This is all kind of tangential to Georgi's question about when the first
public announcement was made, but the point I'm getting at is that the
general principles of stack manipulation to control program flow either
deliberately or unexpectedly had been in the air for some time; so no matter
when the first public announcement of *a* stack-smashing buffer overflow
vulnerability was made, it would already have been common knowledge that
buffer overflows *in general* could be used to manipulate the stack; I don't
suppose there was one initial announcement and then suddenly everyone
realised the stack could be smashed, I reckon lots of people were gradually
putting two and two together independently.
Can't think of a witty .sigline today....
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/