First there are endless ways of stopping DAMAGE from buffer over-runs, from code that accepts user data, eg extend buffer, dont use dangerous strxxx functions .... so while you can move stuff to proxies, and that has been done extensively e.g. for sendmail it is a cop-out, far better fix the application;
Next, while all buffer over runs are very bad it is only those that stamp on the stack, overwriting the return address stored there and implanting viral code to be executed, that are truely __EVIL__. To do that you need to know a lot of things, the architecture ie executing x86 code on a ppc will get you no-where, you must know, and be able to debug your mal-ware against a stable target, and this is why the _VERY_ slowly patched Windoze is so vulnerable, and finally you really need to know the stack base, top of stack, normally growing downward, and ... be able to actually run code out of the stack space; and if any one of these conditions are not true, eg I compiled sendmail with a newer GCC, stack is not executable, ... the exploit just fails or crashes an app and then you go after why? but your system is not compromised. One final point, in practice, you get lots of unwanted packets off the internet, and in general you do not want them on your internal net, both for performance and security reasons, if you drop them on your router or firewall then you dont need to worry if the remote app is mal-ware. -- mit freundlichen Grüßen, Brian. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/