Multiple Stack Protection Scheme Function Argument Overwrite Weakness
BID:4586
Info
Multiple Stack Protection Scheme Function Argument Overwrite Weakness
| Bugtraq ID: | 4586 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Apr 24 2002 12:00AM |
| Updated: | Apr 24 2002 12:00AM |
| Credit: | Discovered by Gerardo Richarte of CORE Security Technologies. |
| Vulnerable: |
StackShield StackShield 0.7 -beta StackGuard StackGuard 2.0.1 StackGuard StackGuard 1.2.1 StackGuard StackGuard 1.2 Microsoft Visual C++.Net |
| Not Vulnerable: | |
Discussion
Multiple Stack Protection Scheme Function Argument Overwrite Weakness
Multiple application-layer technologies exist to prevent exploitation of stack-overflow conditions. A paper describing a number of new weaknesses in these technologies has been recently published.
The weakness described in this report is a lack of protection of function parameters. Affected by this weakness are programs compiled with StackGuard, StackShield, and the Microsoft Visual C++ .NET /GS option.
When a stack overflow occurs, it is often possible for the attacker to overwrite data beyond the procedure activation record. In typical Intel C programs, the data pushed on the stack before the return address when a procedure is invoked is that comprising it's arguments. An attacker is often able to corrupt procedure arguments due to their proximity on the stack. Under specific circumstances, this may result in the ability to write almost anywhere in memory.
Multiple application-layer technologies exist to prevent exploitation of stack-overflow conditions. A paper describing a number of new weaknesses in these technologies has been recently published.
The weakness described in this report is a lack of protection of function parameters. Affected by this weakness are programs compiled with StackGuard, StackShield, and the Microsoft Visual C++ .NET /GS option.
When a stack overflow occurs, it is often possible for the attacker to overwrite data beyond the procedure activation record. In typical Intel C programs, the data pushed on the stack before the return address when a procedure is invoked is that comprising it's arguments. An attacker is often able to corrupt procedure arguments due to their proximity on the stack. Under specific circumstances, this may result in the ability to write almost anywhere in memory.
Exploit / POC
Multiple Stack Protection Scheme Function Argument Overwrite Weakness
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Multiple Stack Protection Scheme Function Argument Overwrite Weakness
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple Stack Protection Scheme Function Argument Overwrite Weakness
References:
References: