My question is: Which buffer overflow / stack smashing defenses (if any) are enabled by default in Debian 6.0 (Squeeze)?
Ubuntu has a handy summary table showing the main security features of each Server edition release, but I haven't found something similar for Debian. Ubuntu mentions:
- Stack Protector (gcc's -fstack-protector)
- Heap Protector (GNU C Library heap protector)
- Pointer Obfuscation (Some pointers stored in glibc are obfuscated)
- Address Space Layout Randomisation (ASLR) (Stack ASLR; Libs/mmap ASLR; Exec ASLR; brk ASLR; VDSO ASLR)
- Several daemons built as Position Independent Executables (PIE)
- Some daemons (?) built with Fortify Source "-D_FORTIFY_SOURCE=2"
To which extent does Debian 6.0 use similar techniques (by default)?