Should firewall have protection against Buffer Overflow attacks?

[Guest]

[comicfan2000]

 Just to throw in a few words, I was wondering if this wouldn't be better for the CAV and Firewall together?  As a firewall, it would have to prevent the stack\address from being written to, and mostly for poorly written code. Wouldn't the firewall have to determine each program, some have well written prevention but how can a firewall decide what to prevent unless it integrates into the system and detects the changes not allowing the return to be written to? Or is this more for blocking the HTTP request from the malicious little bugger etc..We know application gateway\proxy is safer but not 100% either. If a shell is executed and a new account is created, wouldn't CPF have to prevent itself\settings from being tampered with? Wouldn't it change and bypass the firewall if the flow\allowances are changed?  With all this in mind, I in my mind, I am thinking the firewall would have to work as two entities, one to prevent the stack corruption and yet prevent itself from being bypassed and stop controlled flow from a malicious attack? would this slow CPF down?
 
 I don't know that much about buffer overflow as you can tell and may be a bit off, but my mind's gears are turning so I had to ask or else my brain would burn up.    And as you know, I don't explain well so please bare with me.

 Thank you,

 Paul

[marc57]

Just to throw in a few words, I was wondering if this wouldn't be better for the CAV and Firewall together?  As a firewall, it would have to prevent the stack\address from being written to, and mostly for poorly written code. Wouldn't the firewall have to determine each program, some have well written prevention but how can a firewall decide what to prevent unless it integrates into the system and detects the changes not allowing the return to be written to? Or is this more for blocking the HTTP request from the malicious little bugger etc..We know application gateway\proxy is safer but not 100% either. If a shell is executed and a new account is created, wouldn't CPF have to prevent itself\settings from being tampered with? Wouldn't it change and bypass the firewall if the flow\allowances are changed?  With all this in mind, I in my mind, I am thinking the firewall would have to work as two entities, one to prevent the stack corruption and yet prevent itself from being bypassed and stop controlled flow from a malicious attack? would this slow CPF down?
 
 I don't know that much about buffer overflow as you can tell and may be a bit off, but my mind's gears are turning so I had to ask or else my brain would burn up.    And as you know, I don't explain well so please bare with me.

 Thank you,

 Paul

You don't know much about it???  Dang Paul I wish I knew as "little" about it as you do!!!   

[comicfan2000]

You don't know much about it???  Dang Paul I wish I knew as "little" about it as you do!!!   

 loll, I am never sure of what I know to be honest, things change so much in the tech world, what you thought you knew, you no longer know, etc...I know that MS has a patch for the latest exploit on the 10th of October, but as I mentioned, poorly written code is the no.1 bad boy and allowance for BOs. I simply think that if CPF was to try to implement this, it would be a major slowdown to CPF in general. I would think this better left to Anti-virus. For more than one reason. One if CPF uses IDS which I am fairly sure it does, then it already has a fairly good means of protection to BOs. Updating obviously but a specific BO stopper, I don't know.  Some Firewalls do monitor and  prevent the BOs from sending out\executing\connecting from the code to wherever it needs to go ,usually to download the initial hurt after hijacking the firewall, ok, with that said, enter Anti-virus, which won't detect the ins and outs of the malicious code, but when run it will. Now, for both an Anti-virus and Firewall, most will say ONLY ONE can run BO protection , otherwise they will completely clash. This would cause incompatability issues for Comodo as well as other securities and it's own AV if ever implemented into AV. That's all i'm trying to say really and as long as CPF monitors in\out, and people run some form of AV, not all can use proxie, loll, but should be left as is unless it can be done without running up resources. But on the other hand, the people at Comodo know a hell of a lot more than I , and will probably fall over in their chairs laughing when they read my thoughts on this, lollll. I am more or less just giving my opinion and if I am wrong, then I have learned something new.  Married for 15 years, i'm used to being wrong. 


 cheers,

  Paul

[Tags:]