I may be completely stupid here, but don't buffer overflows modify the application as it resides in memory? Everything I've seen on Palladium (which, admittedly, is little) seems
to indicate that it prevents unsigned or altered code from being launched, checking the executable's signature on startup. Would Palladium prevent a variant of Code Red, where a presumably trusted operating system component was overwritten in memory with malicious code? Or is Palladium supposed to constantly monitor running programs in memory for changes?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/96/15720#15720