RE: [cobalt-users] BIND vulnerability

[flash22@xxxxxxx]

On Wed, 31 Jan 2001, Brian Collins wrote:

> If you guys are talking about the critical Bind 8.2.3-Beta > Bind 8.2.3-Rel
> then it deals with heap overflows.While this is a buffer overflow, it occurs
> in the 'bss' or 'heap' region of process memory. It cannot be exploited in
> the same way a stack overflow can be. In addition, this part of memory is
> not executable, therefore any shellcode must somehow be put in the stack.

Umm, on x86 machines this is not true, try this small code snippet:

#include <stdio.h>
#include <malloc.h>

main()
{
char    *cp;
int     (*fn)();

        cp=malloc(32);
        *cp=0xc3;       // x86 return (far)
        fn=cp;
        fn();
        exit(0);
}


if heap isn't executable this should seg fault, but in fact it works just
fine :)