On Wed, 12 Nov 1997 13:32:19 -0500 (EST) 
 Andrew Gillham <gillhaa@ghost.whirlpool.com> wrote:

 > If their patch just looks through the code for '0xf0, 0x0f, 0xc7, 0xc8' 
 > when exec()'ing, then what stops the malicious from reassembling the
 > sequence at runtime?

That is not what their patch does.

Jason R. Thorpe                                       thorpej@nas.nasa.gov
NASA Ames Research Center                            Home: +1 408 866 1912
NAS: M/S 258-6                                       Work: +1 650 604 0935
Moffett Field, CA 94035                             Pager: +1 415 428 6939