A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

16
votes
4answers
768 views

Tricky code to make memory-safe

I'm designing a homework challenge for students who are learning about memory safety and writing secure C code. As part of this, I am looking for a small programming task where it's non-trivial to ...
4
votes
1answer
787 views

Is a return to libc attack possible without the system function?

Every return to libc buffer overflow attack I've seen uses the system function to execute commands. I have an executable with DEP enabled (I can't execute on the stack) and the system function isn't ...
0
votes
2answers
176 views

Why doesn't the CPU verify/enforce matching call/ret addresses?

I've been contemplating the fundamental issue of stack overflows, from the classic shell code injection that doesn't work with NX bit to the newer ROP gadgetry. The first question I had was in ...
1
vote
1answer
1k views

Starting a new shell in a strcpy exploit using buffer overflow

I'm learning about buffer overflows and have this vulnerable code which I'm trying to start a shell from: #include <string.h> void myfunction(char *arg); int main(int argc, char **argv) { ...
1
vote
1answer
373 views

Bounds checking using Intel's MPX

Intel has recently added new instructions to their instruction set to support bounds checking. Intel calls them the Memory Protection Extensions (MPX), and they are described in Chapter 9 of this ...
2
votes
2answers
855 views

Linux Memory Protection from buffer overflow

I am practicing Linux buffer overflow exploitation. when trying to exploit a vulnerability in crossfire, everything works well and I get the shellcode placed in the right place, and the program flow ...
4
votes
2answers
699 views

Smashing the stack if it grows upwards

As we know that on most of the processor architectures, the stack grows downwards. Hence, memory exploits involving smashing of stack and buffer overflow and their explanation make sense. Just ...
2
votes
2answers
2k views

Any reasons to why not use randomize_va_space?

I've been looking a bit into kernel options for hardening, and there is one that seems to be a good idea to deploy - randomize_va_space. But before I activate that feature I started a google search, ...
0
votes
1answer
1k views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
0
votes
2answers
616 views

Can I read/write canary values from %gs register?

I would like to know if it is possible to read (or write) the canary values from %gs register. If "yes", how; and if "no", why? Also, I have been reading somewhere that the canary values are stored ...
0
votes
1answer
73 views

What's the point of storing an copy of args? (the /gs flag)

When you add the /gs argument to microsoft's compiler, it would place a copy of args below the buffer variable. So, what's the point of keeping a copy of arg?
-1
votes
3answers
146 views

There could be still buffer overflows in ex.: C?

I recently read about the $subject. Q: Why does a programming language has built-in trivial insecurity? Or.. it was just in the old times? How could this be?
0
votes
1answer
1k views

Stack buffer overflow confusion

I am trying to dig deeper into the nuts and bolts a stack buffer overflow using the classical NOP-sled technique. Reading some articles and watching videos brought me to a confusion which can be ...
6
votes
3answers
365 views

Buffer overflow stack adjustment

I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. the shellcode was not executed until it was padded with NOPs although its set properly in ...
6
votes
3answers
456 views

What is a buffer overflow?

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly. It has also mentioned how certain bad programming practises involving memory can be ...
2
votes
1answer
160 views

What other place (besides libc) attacker redirect control flow to after an attack such as buffer-overflow succeeded

I am not sure this is a right place to ask this question or not. I want to know in previous or modern type of buffer overflow attack, when the attacker succeeded to overwrite return address, where ...
4
votes
1answer
594 views

How to implement canaries to prevent buffer overflows?

This is probably a very basic question. I've read about canaries, and how they work in theory. You have a global variable that you set to a random number in the prolog of a function, do your function, ...
0
votes
1answer
338 views

ASLR Randomization and different regions [closed]

Essentially my question is, why ASLR doesn't randomize text, bss and data regions of the process? Also in the newer version of kernels (such as Linux kernel version 3.x) along with process base, ...
7
votes
1answer
740 views

How does ASCII-Armoring help to prevent buffer-overflow attacks?

I was reading about return-to-libc attacks at Wikipedia. According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping ...
1
vote
1answer
94 views

How non-executable are implemented? [duplicate]

In the "Hacking the art of Exploitation" its said that the basic idea of stack overflows attacks is that the operating system can't differentiate instructions from data inside the stack ,and the ...
4
votes
1answer
818 views

Is this fprintf statement potentially vulnerable?

Here's the statement: fprintf(stderr, "Some random string\n"). Is it okay not to have a format specifier, such as %s, even though the statement doesn't take any user input? Is it still potentially ...
2
votes
1answer
1k views

Can exploit vulnerability if program started with gdb, but segfaults if started without gdb

i'm currently trying to exploit a simple program called basic_vuln.c #include <stdio.h> int main(int argc, char** argv) { char buf[64]; strcpy(buf, argv[1]); } I'm using xubuntu ...
10
votes
2answers
584 views

AMD64 overflows and null bytes

In the past, I have managed to overflow my own vulnerable programs, and those of others, but only ever in a 32bit environment. Every time I try even a simple stack smash on a 64bit machine, I run into ...
5
votes
1answer
715 views

ROP Exploitation on ARM

I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture. Are there any tools, such as mona.py ...
1
vote
2answers
118 views

How do I sanitize and check large numbers that will be sent to an unmanaged BigNum library like GMP?

I need to process data that is sent by users in a LargeNumber format. My current choices are BigInteger (.Net Managed Code) IntX (Managed Code, faster for some operations) GMP / MPIR (Unmanaged ...
3
votes
1answer
667 views

Occurence of ROP gadget

I'm researching various buffer overflow techniques, one I encounter and is pretty interested in the moment is Return Oriented Programming (ROP), and the use of small groups of instructions known as ...
0
votes
3answers
176 views

if Noscript is secure is that possible our system still compromise by crypto?

perhaps all of us use no-Script when we visit untrusted web pages to block all scripts plugins etc. but still there is something beside plain HTML codes that we don't block; SSL connection! in Https ...
2
votes
1answer
322 views

Stack Smashing problem

I'm currently reading the popular article "Smashing the Stack for fun and profit" by Aleph One but I have a problem. I will try to isolate the problem and present to you only that detail. Even if I ...
1
vote
1answer
402 views

Determining the target address in a heap overflow

For a heap overflow to occur and arbitrary code to be executed, the function free() performs the step : hdr->next->next->prev = hdr->next->prev I understand that the address of ...
1
vote
1answer
564 views

Using an off-by-one buffer overflow can I manipulate EIP to execute code located outside the target program?

This is for a Computer and Network Security class. I am not asking for the solution, rather just a pointer in the right direction. The target program has an off-by-one vulnerability and is compiled ...
1
vote
2answers
316 views

Linux kernel 3.2 syscalls

Just trying to get the assembler instructions for <__execve> of the code below because i want to build the shell spawn opcode list: #include <stdio.h> int main() { char *happy[2]; ...
1
vote
2answers
4k views

Snort false positive?

I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off: GPL SHELLCODE x86 inc ebx NOOP The payload is as ...
9
votes
4answers
708 views

Why don't computers check whether there are memory contents in some memory space?

Buffer overflow occurs because it writes to memory spaces that are used by, or will be used by other parts of the program. Computer programs usually write to the memorylocation that has been ...
4
votes
1answer
570 views

NX bit causes segfault on NOP slide?

doing an assignment for university. We have to exec a shell on a remote server. We're told the NX bit is not set, however, when we redirect to our injected code, the server has a segmentation fault. ...
1
vote
2answers
160 views

Auditing EXEs to ensure buffer overflow protections are in place? (such as SEHOP, ASLR, and DEP)

According to this answer, it's possible to compile a GCC-based application without certain buffer overflow techniques. Perhaps this is even possible with Visual Studio. How can I audit a given EXE ...
19
votes
2answers
4k views

How can vending machines be hacked? And how can I prevent it?

I am developing a vending machine and want to make it secure. In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
3
votes
2answers
871 views

Difference between vulnerabilities on windows/linux/mac for same program

If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on ...
1
vote
1answer
101 views

sigsegv in php5.3.10

I found an overflow situation in php5.3.10. Probably it's not 'something new', but if I can understand this, it will help me to find this kind of bug faster in the future. What can I do to check ...
2
votes
1answer
795 views

SafeSEH and x64

I read here that /SAFESEH is only valid when linking for x86 targets. /SAFESEH is not supported for platforms that already have the exception handlers noted. For example, on x64 and Itanium, ...
5
votes
1answer
409 views

Stack canaries protection and ROP

As far as I know stack canaries are values written on the stack that, if overwritten by a buffer overflow, force the application to close at return. My question is: if I overwrite both EIP and stack ...
3
votes
1answer
2k views

Stack smashing keep getting segmentation fault

I have a homework assignment to do stack smashing, The exploit code creates a badfile in which the vulnerable file reads and buffer over flow occurs. I have already did the 2 commands below to ...
4
votes
2answers
1k views

Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?

Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
5
votes
1answer
2k views

“Hello World” example of a Buffer Overflow attack in many programming languages

I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used Ideally (and if ...
2
votes
1answer
367 views

How to completely prevent bufferoverflows in networking software?

Is that possible to make software which is not vulnerable to any type of buffer overflow? For example, a software that receives data packets and transfers it to destination after data analysis.
7
votes
1answer
520 views

Sulley - optional element and command check

I'm currently using Sulley to fuzz my FTP server, but I'm having problems. I want to specify the STRU command, which has a syntax: STRU [<SP> F|R|P] <CRLF> I tried to specify the ...
4
votes
1answer
224 views

What to do next for this possible buffer overflow?

I've been instructed to test a few of our newer applications before user release, and managed to find a buffer overflow on one of the fields. Here is where I've run into a brick wall though, and ...
1
vote
1answer
60 views

Dangers of a vulnerability in a local installer?

I sent a message to my dev manager about a buffer overflow in our (widely distributed) installer, and received a response that it didn't matter as it wasn't server code. Other than the fact that if ...
4
votes
1answer
1k views

buffer/heap overflow - register of what is executed

When buffer overflow/heap overflow is executed, is EIP the one that tells which part will be executed next? Also, when exploiting the part that has buffer overflow vulnerability, after execution, will ...
36
votes
8answers
3k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
3
votes
1answer
164 views

php_register_variable_ex vulnerability question

Vulnerability I am referring to is: http://www.securityfocus.com/bid/51830 And here in more detail: http://auntitled.blogspot.com/2012/02/mini-poc-for-php-rce-cve-2012-0830.html So basically what ...