there was no ASLR. The stack was at the same address on every execution of `fingerd`. Morris could determine the approximate stack address from his own VAX and use that address in the exploit payload.