A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

15
votes
5answers
3k views

Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?

IIUC the Heartbleed vulnerability happens due to a bug in the C source code of OpenSSL, by performing a memcpy() from a buffer that is too short. I'm wondering if the bug would have been prevented ...
3
votes
4answers
81 views

Should I worry about this UAC bypass exploit for Windows 7?

It appears that there is an exploit out there that allegedly allows you to bypass the UAC on Windows 7 computers and gain administrator access. I was wondering if this exploit is still a dangerous ...
34
votes
7answers
15k views

How to explain buffer overflow to a layman

Every once in a while (when I think out loud and people overhear me) I am forced to explain what a buffer overflow is. Because I can't really think of a good metaphor, I end up spending about 10 ...
1
vote
1answer
70 views

buffer overflow in python script

I am developing a script to perform an a buffer overflow for an assignment in school. However, I am stuck at a point where my payload works injected through the commandline, but not injected through ...
-1
votes
1answer
181 views

Can this code be expoited using Buffer Overflow?

I have a piece of code which contains an obvious buffer overflow at strcpy(buf, x) since it doesn't check if buf is large enough to fit the string x. I'm wondering how to actually exploit this bug. ...
1
vote
2answers
129 views

Python exploit question?

Can someone please explain how and why this struct.pack code is used in the below exploit? I'm trying to understand how it triggers the vulnerability. I understand the buffer overflow aspect, I'm ...
2
votes
1answer
59 views

EIP pointer is overwritten but EBP remains intact

I was trying out a simple stack buffer overflow exploit by creating a malicious crash.m3u file. as you can see the EIP pointer is overwritten by "A" but EBP hasn't changed. isn't EBP supposed to get ...
0
votes
1answer
55 views

Why does this buffer overflow have payload &system-&exit-&BINSH

I'm following a tutorial to write a simple buffer overflow. I have (basic) knowledge of assembly, and the stack. I've written a stack based buffer overflow before and understood it. The program I'm ...
2
votes
2answers
39 views

Inversed Data Direction on the Stack

As I remember from my micro controller course, the stack is at the end of the memory, while at the begin are some interrupt pointers, program code and later data. Since the stack is at the end of the ...
-2
votes
1answer
78 views

Examples of images causing buffer overflows? [closed]

I remember reading a news article of an incident where a hacker was able to use an image to infect thousands (maybe millions?) of computers. Can anyone provide links to such news articles? I couldn't ...
0
votes
1answer
60 views

Using buffer overflow on word with macro injection

I know how a buffer overflow works on a local network against an application running on a TCP port, assuming it doesn't drop the connection, but I would like some advice on an "exploit" I would like ...
0
votes
1answer
90 views

Is there any security concerns for CGI scripts written in pure bash?

I'm working on a project that would use bash and fastcgi to create a psudo-CMS, is there any kind of security concerns to watch out for (ie buffer overflows, and the like)?
2
votes
2answers
185 views

NX bit: does it protect the stack?

I once heard the NX bit was a panacea, then that it was not. One detail I've wondered about though: Does the NX (no execute) bit protect against code inserted into the stack and executed there? It ...
3
votes
1answer
81 views

Tracking down the source of email attacks

For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
2
votes
1answer
391 views

How to learn programming from a hacker's prospective [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming ...
1
vote
1answer
230 views

Buffer Overflow on Raspberry PI

Is the ARM processor used on the Raspberry Pi vulnerable to standard buffer overflows? That is, if a program that has a BO vulnerability is run on a Pi, will it be vulnerable to exploit? How does ...
16
votes
4answers
674 views

Tricky code to make memory-safe

I'm designing a homework challenge for students who are learning about memory safety and writing secure C code. As part of this, I am looking for a small programming task where it's non-trivial to ...
0
votes
2answers
88 views

Why doesn't the CPU verify/enforce matching call/ret addresses?

I've been contemplating the fundamental issue of stack overflows, from the classic shell code injection that doesn't work with NX bit to the newer ROP gadgetry. The first question I had was in ...
1
vote
1answer
298 views

Starting a new shell in a strcpy exploit using buffer overflow

I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from: #include <string.h> void myfunction(char *arg); int main(int argc, char **argv) { ...
4
votes
1answer
160 views

On Hawkes' technique to bypass canaries

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force ...
3
votes
1answer
165 views

Is a return to libc attack possible without the system function?

Every return to libc buffer overflow attack I've seen uses the system function to execute commands. I have an executable with DEP enabled (I can't execute on the stack) and the system function isn't ...
1
vote
1answer
96 views

Bounds checking using Intel's MPX

Intel has recently added new instructions to their instruction set to support bounds checking. Intel calls them the Memory Protection Extensions (MPX), and they are described in Chapter 9 of this ...
4
votes
2answers
195 views

Smashing the stack if it grows upwards

As we know that on most of the processor architectures, the stack grows downwards. Hence, memory exploits involving smashing of stack and buffer overflow and their explanation make sense. Just ...
11
votes
1answer
457 views

Return-oriented programming: how to find a stack pivot

I have a program with a heap overflow. It contains some code that is not randomized (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first ...
0
votes
1answer
347 views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
4
votes
3answers
1k views

How is printf() in C/C++ a Buffer overflow vulnerability?

According to an article I just read, the functions printf and strcpy are considered security vulnerabilities due to Buffer overflows. I understand how strcpy is vulnerable, but could someone possibly ...
0
votes
2answers
180 views

Can I read/write canary values from %gs register?

I would like to know if it is possible to read (or write) the canary values from %gs register. If "yes", how; and if "no", why? Also, I have been reading somewhere that the canary values are stored ...
2
votes
1answer
342 views

Explaining a buffer overflow vulnerability in C

Given this C program: #include <stdio.h> #include <string.h> int main(int argc, char **argv) { char buf[1024]; strcpy(buf, argv[1]); } Built with: gcc -m32 -z execstack prog.c -o ...
0
votes
1answer
65 views

What's the point of storing an copy of args? (the /gs flag)

When you add the /gs argument to microsoft's compiler, it would place a copy of args below the buffer variable. So, what's the point of keeping a copy of arg?
3
votes
1answer
319 views

How does SEH based exploit bypass DEP and ASLR?

I am new to structured exception handling based exploits. Why don't we put our return address directly in SE handler to jump to our shellcode? (with no safe SEH) Can anybody explain the reason of ...
6
votes
2answers
210 views

How stack smashing is prevented?

I just read AlephOne's paper on smashing the stack, and implemented it on my machine (Ubuntu 12.04), it was a bit old so had to take a lot of help from the internet but I enjoyed it. Now, I want to ...
-1
votes
3answers
119 views

There could be still buffer overflows in ex.: C?

I recently read about the $subject. Q: Why does a programming language has built-in trivial insecurity? Or.. it was just in the old times? How could this be?
0
votes
1answer
240 views

Stack buffer overflow confusion

I am trying to dig deeper into the nuts and bolts a stack buffer overflow using the classical NOP-sled technique. Reading some articles and watching videos brought me to a confusion which can be ...
5
votes
3answers
197 views

Buffer overflow stack adjustment

I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. the shellcode was not executed until it was padded with NOPs although its set properly in ...
1
vote
2answers
419 views

Linux Memory Protection from buffer overflow

I am practicing Linux buffer overflow exploitation. when trying to exploit a vulnerability in crossfire, everything works well and I get the shellcode placed in the right place, and the program flow ...
4
votes
3answers
195 views

What is a buffer overflow?

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly. It has also mentioned how certain bad programming practises involving memory can be ...
2
votes
1answer
180 views

How to implement canaries to prevent buffer overflows?

This is probably a very basic question. I've read about canaries, and how they work in theory. You have a global variable that you set to a random number in the prolog of a function, do your function, ...
2
votes
1answer
138 views

What other place (besides libc) attacker redirect control flow to after an attack such as buffer-overflow succeeded

I am not sure this is a right place to ask this question or not. I want to know in previous or modern type of buffer overflow attack, when the attacker succeeded to overwrite return address, where ...
-1
votes
1answer
146 views

ASLR Randomization and different regions [closed]

Essentially my question is, why ASLR doesn't randomize text, bss and data regions of the process? Also in the newer version of kernels (such as Linux kernel version 3.x) along with process base, ...
6
votes
1answer
361 views

How does ASCII-Armoring help to prevent buffer-overflow attacks?

I was reading about return-to-libc attacks at Wikipedia. According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping ...
4
votes
3answers
475 views

Is writing shellcode still a valid skill to have/learn?

Following up from this question: Should I bother teaching buffer overflows any more? I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
1
vote
1answer
71 views

How non-executable are implemented? [duplicate]

In the "Hacking the art of Exploitation" its said that the basic idea of stack overflows attacks is that the operating system can't differentiate instructions from data inside the stack ,and the ...
2
votes
1answer
180 views

Bypass va_randomize_space and stack-protector

Is a program compiled with the GCC -fstack-protector option and running in a Linux environment with the va_randomize_space kernel variable set to 1, totally protected against buffer overflow attacks? ...
4
votes
1answer
363 views

Is this fprintf statement potentially vulnerable?

Here's the statement: fprintf(stderr, "Some random string\n"). Is it okay not to have a format specifier, such as %s, even though the statement doesn't take any user input? Is it still potentially ...
1
vote
1answer
437 views

Can exploit vulnerability if program started with gdb, but segfaults if started without gdb

i'm currently trying to exploit a simple program called basic_vuln.c #include <stdio.h> int main(int argc, char** argv) { char buf[64]; strcpy(buf, argv[1]); } I'm using xubuntu ...
1
vote
2answers
85 views

How do I sanitize and check large numbers that will be sent to an unmanaged BigNum library like GMP?

I need to process data that is sent by users in a LargeNumber format. My current choices are BigInteger (.Net Managed Code) IntX (Managed Code, faster for some operations) GMP / MPIR (Unmanaged ...
2
votes
1answer
401 views

Occurence of ROP gadget

I'm researching various buffer overflow techniques, one I encounter and is pretty interested in the moment is Return Oriented Programming (ROP), and the use of small groups of instructions known as ...
0
votes
3answers
157 views

if Noscript is secure is that possible our system still compromise by crypto?

perhaps all of us use no-Script when we visit untrusted web pages to block all scripts plugins etc. but still there is something beside plain HTML codes that we don't block; SSL connection! in Https ...
2
votes
1answer
232 views

Stack Smashing problem

I'm currently reading the popular article "Smashing the Stack for fun and profit" by Aleph One but I have a problem. I will try to isolate the problem and present to you only that detail. Even if I ...
1
vote
1answer
275 views

Using an off-by-one buffer overflow can I manipulate EIP to execute code located outside the target program?

This is for a Computer and Network Security class. I am not asking for the solution, rather just a pointer in the right direction. The target program has an off-by-one vulnerability and is compiled ...