| |||||||||||||
Security hardening for DebianSecurity hardening for DebianPosted Feb 7, 2008 5:37 UTC (Thu) by jimparis (subscriber, #38647)Parent article: Security hardening for Debian
For format string attacks, why isn't there a simple option to just disable "%n" processing entirely? So few applications actually need it. You'd still be vulnerable to information disclosure if you process an untrusted format string, but an actual exploit capable of running external code should be nigh impossible without %n.
(Log in to post comments)
Security hardening for Debian Posted Feb 7, 2008 12:45 UTC (Thu) by nix (subscriber, #2304) [Link] That's pretty much how -D_FORTIFY_SOURCE=2 differs from -D_FORTIFY_SOURCE. (Debian is using the former.)
|
|||||||||||||