Re: [gentoo-hardened] Firefox+PaX+amazon.com

On Hét, November 5, 2007 02:22, pageexec@××××××××.hu wrote:
> On 5 Nov 2007 at 2:36, atoth@××××××××××.hu wrote:
>
>> Shame on me: permissions fixed.
>
> ok, next question: the coredump should be around 300MB, are you sure
> it wasn't truncated? in any case, uploading that much is probably not
> practical (and could expose personal info since all data mappings are
> in it), so it's probably if you skip it ;). you could still look at it

That was the case. I didn't capture the whole core.

> in gdb and disasm the code beginning at 0x13027000 (that would have
> been executed were it not for PaX).

I've tried to reproduce the symptom for a gdb core file session, but the
problem seems to be solved. I didn't reinstalled Firefox, so I guess some
incorrect contents were removed (probably flash). Nevertheless I watch out
for these and supply some more information next time I'll run into a
situation like this.

>
>> I give MPROTECT a try. But just for curiosity. I don't like the idea
>> running firefox without MPROTECT. I was disappointed when I had to turn
>> of
>> MPROTECT on python to get python-UNO bridge running.
>
> if it's the same UNO that openoffice uses then it's a tough nut, last
> i looked it seemed some overengineered uebercomplex piece of code for
> god knows what gain, rewriting it would take a lot of time if at all
> possible. at least they make a best effort at runtime code generation,

There's a citation reference program called "bibus". This one is attached
to openoffice using the python-UNO bridge.

> unlike your case where the 0x13027000 area was clearly non-executable,
> so there's a bug in whichever module created it (if you feel like
> debugging
> it, strace/gdb are your friends ;).

Thanks for your help.

Regards,
Dw.

>
> --
> gentoo-hardened@g.o mailing list
>


-- 
gentoo-hardened@g.o mailing list