HOST policy-Exec stack

Oracle EM GRID CONTROL报

Category        Security
Description    Ensure that the OS configuration parameter, which enables execution of code on the user stack, is not enabled

官方文档：
Oracle® Enterprise Manager Policy Reference Manual 10g Release 5 (10.2.0.5) 5.2 Security Policies

http://docs.oracle.com/cd/B19306_01/em.102/b16231/host.htm#sthref1357

5.2 Security Policies

The security policies for the Host target are:

5.2.1 Execute Stack

This policy ensures that the Operating System configuration parameter, which enables execution of code on the user stack, is not enabled.

Policy Summary

The following table lists the policy's main properties.

Severity	Category	Target Type	Versions Affected	Policy Rule EvaluationFoot 1	Automatically Enabled?	Alert Message
Warning	Security	Host	All UNIX-Based Operating Systems	The underlying metric is executeStackRep which has a collection frequency of once every 24 hours.	Yes	The host is in an insecure state. Executable code on the user stack is enabled.

The policy rule is evaluated each time its underlying metric is collected.

Defaults

Parameters and Their Default Values

None

Objects Excluded by Default

Not Applicable

Impact of Violation

Enabling code execution on the user stack may allow a malicious user to exploit stack buffer overflows. Overflows can cause portions of a system to fail, or even execute arbitrary code.

Action

Disable code execution on the user stack.

----------------------------------------------------------------------------   华丽的分隔线    -----------------------------------------------------------------------------------------

相关连接：

PAE  Physical_Address_Extension
http://en.wikipedia.org/wiki/Physical_Address_Extension
这是操作系统上扩展内存的，32位的系统理论最大支持4G，使用PAE就可以打破4G，64位最大支持一般因操作系统版本，有的支持上T的内存
当然也需要CPU芯片的支持
NX bit
http://en.wikipedia.org/wiki/NX_bit
而oracle认为在32位系统上开启此特性会造成安全问题，容易造成space overflow被一些malicious software利用，比方 可以在linux 模拟突破C++的虚拟指针－－C++程序的缓冲区溢出攻击
policy默认级别critical

扩展阅读：《内核漏洞的利用与防范》:  http://book.51cto.com/art/201203/324044.htm

AIX官方有对这个解释

http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.security/doc/security/stack_exec_disable.htm

   There is increasing likelihood of computer systems falling prey to sophisticated attacks, resulting in disruption to the daily operations of businesses and government agencies. While no security measure can provide foolproof protection against attacks, you should deploy multiple security mechanisms to thwart security attacks. This section covers a security mechanism that is used with AIX® to thwart attacks due to buffer overflow based execution.

    Security breaches occur in many forms, but one of the most common methods is to monitor the system-provided administrative tools, look for, and exploit buffer overflows. Buffer overflow attacks occur when an internal program buffer is overwritten because data was not properly validated (such as command line, environmental variable, disk or terminal I/O). Attack code is inserted into a running process through the buffer overflow, changing the execution path of the running process. The return address is overwritten and redirected to the inserted-code location. Common causes of breaches include improper or nonexistent bounds checking, or incorrect assumptions about the validity of data sources. For example, a buffer overflow can occur when a data object is large enough to hold 1 KB of data, but the program does not check the bounds of the input and hence can be made to copy more than 1 KB into that data object.

    The intruder's goal is to attack a command and/or tool that provides root privileges to a regular user. Control of the program is gained with all the privileges enabled, permitting overflow of the buffers. Attacks are typically focused on a root owned UID set or programs leading to the execution of a shell, thereby gaining root-based shell access to the system.

  You can prevent these attacks by blocking execution of attack code entering through the buffer overflow. Disable execution on the memory areas of a process where execution commonly does not take place (stack and heap memory areas).

解决方法：

1. 打non executable patch

2. 就是对于自己熟悉的share lib或者shell用execstack进行静态的绑定，避免其占用overflow的exec stack以及 heap memory areas

execstack的使用方法，http://linux.die.net/man/8/execstack

Usage: execstack [OPTION...]
execstack -- program to query or set executable stack flag

  -c, --clear-execstack      Clear executable stack flag bit
  -q, --query                Query executable stack flag bit
  -s, --set-execstack        Set executable stack flag bit
  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version