Linked by Thom Holwerda on Thu 9th Aug 2007 17:02 UTC, submitted by Joe User
University of Cambridge researcher Robert Watson has published a paper at the First USENIX Workshop On Offensive Technology in which he describes serious vulnerabilities in OpenBSD's Systrace, Sudo, Sysjail, the TIS GSWTK framework, and CerbNG. The technique is also effective against many commercially available anti-virus systems. His slides include sample exploit code that bypasses access control, virtualization, and intrusion detection in under 20 lines of C code consisting solely of memcpy() and fork(). Sysjail has now withdrawn their software, recommending against any use, and NetBSD has disabled Systrace by default in their upcoming release.
Permalink for comment 262026
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
Recent Original Stories
Recent Comments
Headlines
Random Comments
Random Stories
Random OS Link
Member since:
2006-04-25
.. that this is only exploitable on multiprocessor systems.
Also, it seems that there is a solution available:
There is a straight forward solution for this problem. The initial
prototype of Systrace had a look-aside buffer in the kernel for
copyin. I told Robert about this, not sure if he mentioned that in
his paper or not. There obviously would be some associated
performance impacts. (Niels Provos, on the OpenBSD mailing list)
Still pretty serious though.