A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

35
votes
3answers
21k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
7
votes
2answers
451 views

Why are buffer overflows executed in the direction they are?

I'm following The Security Tube’s video here. He overviews buffer overflows, and mentions how memory is executed from highest to lowest in the stack (at least with his implementation I assume). So we ...
10
votes
1answer
1k views

Exploiting buffer overflow leads to segfault

I am trying to exploit simple stack overflow vulnerability. I have a basic code in c: #include <cstring> int main( int argc, char** argv ) { char buffer[500]; strcpy(buffer, ...
35
votes
2answers
5k views

What is the most hardened set of options for GCC compiling C/C++?

What set of GCC options provide the best protection against memory corruption vulnerabilities such as Buffer Overflows, and Dangling Pointers? Does GCC provide any type of ROP chain mitigation? Are ...
5
votes
1answer
2k views

“Hello World” example of a Buffer Overflow attack in many programming languages

I'm looking for a very simple application that has an intentional Buffer Overflow embedded in it. I'm assuming this possible in systems where DEP and ASLR are not being used Ideally (and if ...
9
votes
4answers
693 views

Why don't computers check whether there are memory contents in some memory space?

Buffer overflow occurs because it writes to memory spaces that are used by, or will be used by other parts of the program. Computer programs usually write to the memorylocation that has been ...
1
vote
1answer
311 views

Defend against Blind ROP

At IEEE Security & Privacy, the blind return-oriented programming attack (blind ROP) was just introduced. In some sense, this is just another variation on ROP attacks -- but the blind ROP attack ...
40
votes
7answers
19k views

How to explain buffer overflow to a layman

Every once in a while (when I think out loud and people overhear me) I am forced to explain what a buffer overflow is. Because I can't really think of a good metaphor, I end up spending about 10 ...
36
votes
8answers
3k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
19
votes
2answers
4k views

How can vending machines be hacked? And how can I prevent it?

I am developing a vending machine and want to make it secure. In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
5
votes
2answers
416 views

On Hawkes' technique to bypass canaries

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force ...
6
votes
3answers
423 views

What is a buffer overflow?

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly. It has also mentioned how certain bad programming practises involving memory can be ...
2
votes
1answer
88 views

How to find stack pointer for overflow bug?

I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I ...
1
vote
0answers
32 views

Can you get infected by viewing an image? [duplicate]

Lets say I have an infected image by some malware, I double-click it and that triggers the default program that handles images to open it for viewing. Will this also trigger the malware inside the ...
0
votes
0answers
172 views

Stack buffer overflow: Is compiler changing variables order, preventing me to overwrite EIP properly?

I am learning about stack buffer overflow. A little info about my target: A x86 little endian intel-based computer, with a target compiled with TCC Compiler with no protections of any kind running on ...
0
votes
3answers
175 views

if Noscript is secure is that possible our system still compromise by crypto?

perhaps all of us use no-Script when we visit untrusted web pages to block all scripts plugins etc. but still there is something beside plain HTML codes that we don't block; SSL connection! in Https ...