Re: [Full-Disclosure] EFC Released

[Matthias Stiller <matthias@xxxxxxxxxxxxxxxxxx>]

Balwinder Singh wrote:
> Dear All,
>
> Execution Flow Control (EFC) is available for download at
> http://sourceforge.net/projects/efc/
>
> What is EFC?
>
> EFC monitors the execution of a program by observing system calls made
> by the program. EFC generates a database for each program describing 
> its behavioral model. The moment request for execution of a program is
> made, kernel also loads program's behavioral model into the memory.
> Each request by a program is compared with model data base, if request
> agrees with model it is permitted else program is killed. 
>
> EFC is a kernel module, and woks on Linux only.
>
> Sincerely
>
> Bal
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

Hi Bal,

Although I appriciate ideas to enhance security concerning buffer 
overflows or format string bugs, i cannot understand why to find
the following lines in etc_db_new.c including your package:

<snip>
char pwd[MAX_PATH_LEN];
...
i = 0;
while((ch = fgetc(strace_file)) != '\0') {
  pwd[i] = ch;
  i++;
}
...
</snip>
Haven't found any made borders. And yes, due to its permissions it won't 
let people become root ... it is just a cosmetic failure. (hopefully) :)

Moreover, and that is the actual reason for replying your mail ...
I couldn't find the patch in $EFC_PATH/efc/ ... did I just download a 
non complete package?

Regards,
Matthias Stiller

--
http://www.inet-sec.org/~realk/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html