Log In
Home
07/30/2019
Offline
Address Space Layout Randomization (ASLR) not enabled.
=========================================
The following OPC binaries do not have ASLR enabled when allocating dynamic memory.
- opccomn_ps.dll (version: 1.10.105.1)
- opcproxy.dll (Version: 3.0.105.1)
I would like to know whether which version of above dll are having "ASLR" enable option and from where I can get it. Could anyone give opinion on it.
05/30/2017
Offline
The DLLs may predate that feature in the C++ compilers and it is likely not a good idea to turn it on because those DLLs are shared by many different applications and changes like that could break something.
07/30/2019
Offline
Randy Armstrong said
The DLLs may predate that feature in the C++ compilers and it is likely not a good idea to turn it on because those DLLs are shared by many different applications and changes like that could break something.
Thank you so much for the information. I would like to get the latest source code of the two binaries (opccomn_ps.dll, opcproxy.dll). Could you please provide link or reference from where I can get the source code downloaded.
05/30/2017
Offline
These DLLs cannot be built by individual vendors because only one version of the DLL can be installed on a system. The source code is available but only for developer testing - it should never be used to build copies of the proxies for distribution.
07/30/2019
Offline
Could you please share your recommendation to mitigate risk associated with not enabling ASLR.
Is there any plan/timeline in the near future to have this addressed, please share the timeline.
05/30/2017
Offline
I suggest you do some testing after enabling system wide mandatory ASLR on Windows 8 or later:
https://msrc-blog.microsoft.co.....tory-aslr/
It can be used with DLLs that have not enabled ASLR and should give you "better than nothing" protection when you control the specific systems that are being used.
There are no plans to make any changes to proxy/stubs because they are used by thousands of applications that are not maintained anymore and could break if ASLR is enabled in the proxy/stubs. The link above indicates that Microsoft has limited the effectiveness of the mandatory ASLR specifically because of the risk of creating problems with legacy applications.
06/23/2016
Offline
Hi Randy,
I understand that the source code is available for testing purposes only. Could you please share where to access the code for these libraries?
Thanks! 🙂
05/30/2017
Offline
All code is here:
https://opcfoundation.org/deve.....urce-code/
Only available to Corporate Members.
1 Guest(s)
Usage Policy