A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

0
votes
0answers
90 views

Is OpenSSL 0.9.8h affected by CVE-2014-0195?

I have spent time on finding out if OpenSSL 098h is affected by the CVE-2014-0195 ..but it seems I will have to understand the entire file d1_both.c to answer this question. 1) Preliminary look at ...
4
votes
2answers
243 views

Heap canaries, to protect function pointers in heap objects

I'm wondering if anyone has previously proposed, evaluated, or deployed the following measure to harden systems against heap-based buffer overruns: basically, stack canaries, but applied before ...
1
vote
2answers
265 views

Heap spray against 64-bit processes - possible?

Are heap spray exploits possible, if the process we're attacking is a 64-bit process? Naively, it seems like the 64-bit address makes it difficult to mount a heap spray: to fill all (or a significant ...
4
votes
1answer
177 views

Why are countermeasures against control-flow hijacking attacks mostly implemented in software?

I wonder why countermeasures against code-injection and control-flow hijacking attacks (e.g. stack-based buffer overflows and heap-based buffer overflows) are mostly implemented in software. Examples ...
5
votes
1answer
242 views

Information disclosure attack, using a heap overflow

A typical strategy for defeating ASLR is to find both a buffer overflow bug and an information disclosure bug. But when attacking servers that are automatically restarted whenever they crash/die, is ...
0
votes
1answer
71 views

libraries alternative to gcc stack-protector / fortity source feature on linux

is there external library/approach/whatever to add canary protection (stack-protector equivalent) extra buffer boundary check (fortity source equivalent) on a C software without using glibc / ...
-1
votes
1answer
182 views

Stack-based buffer overflow the program is interpreting the shellcode on its own

I'm beginner in exploits. So I had type simple program in C #include <stdio.h> void func(){ printf("asd"); } main(){ char buf[100]; scanf("%s", &buf); } My goal is to run the ...
-2
votes
1answer
158 views

Buffer Overflow Exploit Shellcode for Windows

Using a buffer overflow, I have been able to override return addresses. But the problem is that Windows addresses contain zeros at the beginning (e.g. 0x00401020). As a result, the objdump of any C ...
2
votes
1answer
93 views

Does ASLR protect against a buffer overflow within a struct?

Assume a simple struct: struct test { char variable[4]; char variable2; } If I write something like variable[4] = '\0' there is a buffer overflow which modifies variable2. Does ASLR prevent ...
15
votes
5answers
5k views

Would the Heartbleed bug have been prevented if OpenSSL was written in Go/D/Vala?

IIUC the Heartbleed vulnerability happens due to a bug in the C source code of OpenSSL, by performing a memcpy() from a buffer that is too short. I'm wondering if the bug would have been prevented ...
1
vote
1answer
88 views

Examples of software web clients (web browsers, IM clients, etc) written in “secure” / managed languages

After reading this article ("Everything is broken" by Quinn Norton) I was about to ask a question similar to this one (Why are security-crucial software written in unsafe languages?)... but actually I ...
1
vote
1answer
242 views

Defend against Blind ROP

At IEEE Security & Privacy, the blind return-oriented programming attack (blind ROP) was just introduced. In some sense, this is just another variation on ROP attacks -- but the blind ROP attack ...
2
votes
2answers
143 views

Why is it so difficult to protect an application against buffer overflows?

For example, buffer overflow vulnerabilities in Flash are often discovered. Shouldn't a proper verification of all function parameters in Flash source code be enough to protect against buffer ...
3
votes
1answer
500 views

How does SEH based exploit bypass DEP and ASLR?

I am new to structured exception handling based exploits. Why don't we put our return address directly in SE handler to jump to our shellcode? (with no safe SEH) Can anybody explain the reason of ...
3
votes
4answers
3k views

Should I worry about this UAC bypass exploit for Windows 7?

It appears that there is an exploit out there that allegedly allows you to bypass the UAC on Windows 7 computers and gain administrator access. I was wondering if this exploit is still a dangerous ...
40
votes
7answers
18k views

How to explain buffer overflow to a layman

Every once in a while (when I think out loud and people overhear me) I am forced to explain what a buffer overflow is. Because I can't really think of a good metaphor, I end up spending about 10 ...
4
votes
3answers
673 views

Is writing shellcode still a valid skill to have/learn?

Following up from this question: Should I bother teaching buffer overflows any more? I am a it sec researcher and also security course instructor. Recently questions have been raised about the ...
6
votes
3answers
4k views

How to get this to buffer overflow?

I'm trying to understand buffer overflow, and am working with a simple piece of code, as below. #include <stdlib.h> #include <stdio.h> #include <string.h> int bof(char *str) { ...
-1
votes
1answer
290 views

Can this code be expoited using Buffer Overflow?

I have a piece of code which contains an obvious buffer overflow at strcpy(buf, x) since it doesn't check if buf is large enough to fit the string x. I'm wondering how to actually exploit this bug. ...
3
votes
1answer
444 views

Bypass va_randomize_space and stack-protector

Is a program compiled with the GCC -fstack-protector option and running in a Linux environment with the va_randomize_space kernel variable set to 1, totally protected against buffer overflow attacks? ...
1
vote
2answers
551 views

Python exploit question?

Can someone please explain how and why this struct.pack code is used in the below exploit? I'm trying to understand how it triggers the vulnerability. I understand the buffer overflow aspect, I'm ...
2
votes
1answer
283 views

EIP pointer is overwritten but EBP remains intact

I was trying out a simple stack buffer overflow exploit by creating a malicious crash.m3u file. as you can see the EIP pointer is overwritten by "A" but EBP hasn't changed. isn't EBP supposed to get ...
0
votes
1answer
209 views

Using buffer overflow on word with macro injection

I know how a buffer overflow works on a local network against an application running on a TCP port, assuming it doesn't drop the connection, but I would like some advice on an "exploit" I would like ...
0
votes
1answer
161 views

Why does this buffer overflow have payload &system-&exit-&BINSH

I'm following a tutorial to write a simple buffer overflow. I have (basic) knowledge of assembly, and the stack. I've written a stack based buffer overflow before and understood it. The program I'm ...
3
votes
2answers
59 views

Inversed Data Direction on the Stack

As I remember from my micro controller course, the stack is at the end of the memory, while at the begin are some interrupt pointers, program code and later data. Since the stack is at the end of the ...
-2
votes
1answer
230 views

Examples of images causing buffer overflows? [closed]

I remember reading a news article of an incident where a hacker was able to use an image to infect thousands (maybe millions?) of computers. Can anyone provide links to such news articles? I couldn't ...
1
vote
1answer
124 views

Is there any security concerns for CGI scripts written in pure bash?

I'm working on a project that would use bash and fastcgi to create a psudo-CMS, is there any kind of security concerns to watch out for (ie buffer overflows, and the like)?
2
votes
2answers
922 views

NX bit: does it protect the stack?

I once heard the NX bit was a panacea, then that it was not. One detail I've wondered about though: Does the NX (no execute) bit protect against code inserted into the stack and executed there? It ...
3
votes
1answer
119 views

Tracking down the source of email attacks

For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
2
votes
1answer
3k views

How to learn programming from a hacker's prospective [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming ...
16
votes
4answers
738 views

Tricky code to make memory-safe

I'm designing a homework challenge for students who are learning about memory safety and writing secure C code. As part of this, I am looking for a small programming task where it's non-trivial to ...
4
votes
1answer
601 views

Is a return to libc attack possible without the system function?

Every return to libc buffer overflow attack I've seen uses the system function to execute commands. I have an executable with DEP enabled (I can't execute on the stack) and the system function isn't ...
0
votes
2answers
129 views

Why doesn't the CPU verify/enforce matching call/ret addresses?

I've been contemplating the fundamental issue of stack overflows, from the classic shell code injection that doesn't work with NX bit to the newer ROP gadgetry. The first question I had was in ...
1
vote
1answer
1k views

Starting a new shell in a strcpy exploit using buffer overflow

I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from: #include <string.h> void myfunction(char *arg); int main(int argc, char **argv) { ...
1
vote
1answer
295 views

Bounds checking using Intel's MPX

Intel has recently added new instructions to their instruction set to support bounds checking. Intel calls them the Memory Protection Extensions (MPX), and they are described in Chapter 9 of this ...
2
votes
2answers
751 views

Linux Memory Protection from buffer overflow

I am practicing Linux buffer overflow exploitation. when trying to exploit a vulnerability in crossfire, everything works well and I get the shellcode placed in the right place, and the program flow ...
4
votes
2answers
594 views

Smashing the stack if it grows upwards

As we know that on most of the processor architectures, the stack grows downwards. Hence, memory exploits involving smashing of stack and buffer overflow and their explanation make sense. Just ...
1
vote
2answers
2k views

Any reasons to why not use randomize_va_space?

I've been looking a bit into kernel options for hardening, and there is one that seems to be a good idea to deploy - randomize_va_space. But before I activate that feature I started a google search, ...
0
votes
1answer
970 views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
0
votes
2answers
463 views

Can I read/write canary values from %gs register?

I would like to know if it is possible to read (or write) the canary values from %gs register. If "yes", how; and if "no", why? Also, I have been reading somewhere that the canary values are stored ...
0
votes
1answer
72 views

What's the point of storing an copy of args? (the /gs flag)

When you add the /gs argument to microsoft's compiler, it would place a copy of args below the buffer variable. So, what's the point of keeping a copy of arg?
-1
votes
3answers
142 views

There could be still buffer overflows in ex.: C?

I recently read about the $subject. Q: Why does a programming language has built-in trivial insecurity? Or.. it was just in the old times? How could this be?
0
votes
1answer
882 views

Stack buffer overflow confusion

I am trying to dig deeper into the nuts and bolts a stack buffer overflow using the classical NOP-sled technique. Reading some articles and watching videos brought me to a confusion which can be ...
6
votes
3answers
310 views

Buffer overflow stack adjustment

I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. the shellcode was not executed until it was padded with NOPs although its set properly in ...
6
votes
3answers
377 views

What is a buffer overflow?

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly. It has also mentioned how certain bad programming practises involving memory can be ...
2
votes
1answer
152 views

What other place (besides libc) attacker redirect control flow to after an attack such as buffer-overflow succeeded

I am not sure this is a right place to ask this question or not. I want to know in previous or modern type of buffer overflow attack, when the attacker succeeded to overwrite return address, where ...
4
votes
1answer
443 views

How to implement canaries to prevent buffer overflows?

This is probably a very basic question. I've read about canaries, and how they work in theory. You have a global variable that you set to a random number in the prolog of a function, do your function, ...
0
votes
1answer
283 views

ASLR Randomization and different regions [closed]

Essentially my question is, why ASLR doesn't randomize text, bss and data regions of the process? Also in the newer version of kernels (such as Linux kernel version 3.x) along with process base, ...
7
votes
1answer
574 views

How does ASCII-Armoring help to prevent buffer-overflow attacks?

I was reading about return-to-libc attacks at Wikipedia. According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping ...
1
vote
1answer
83 views

How non-executable are implemented? [duplicate]

In the "Hacking the art of Exploitation" its said that the basic idea of stack overflows attacks is that the operating system can't differentiate instructions from data inside the stack ,and the ...