A buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory.

learn more… | top users | synonyms

49
votes
3answers
39k views

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

To prevent buffer overflows, there are several protections available such as using Canary values, ASLR, DEP, NX. But, where there is a will, there is a way. I am researching on the various methods an ...
10
votes
2answers
1k views

Why are buffer overflows executed in the direction they are?

I'm following The Security Tube’s video here. He overviews buffer overflows, and mentions how memory is executed from highest to lowest in the stack (at least with his implementation I assume). So we ...
16
votes
1answer
4k views

Exploiting buffer overflow leads to segfault

I am trying to exploit simple stack overflow vulnerability. I have a basic code in c: #include <cstring> int main( int argc, char** argv ) { char buffer[500]; strcpy(buffer, ...
19
votes
4answers
2k views

Security Implications of Neglecting the Extra Byte for NULL Termination in C/C++ Arrays

Please Consider: English is my second language. On the Security Now! podcast episode 518 (HORNET: A Fix for TOR?), at the 27:51 mark Steve Gibson quotes an example of vulnerable code in C/C++: ...
45
votes
7answers
24k views

How to explain buffer overflow to a layman

Every once in a while (when I think out loud and people overhear me) I am forced to explain what a buffer overflow is. Because I can't really think of a good metaphor, I end up spending about 10 ...
3
votes
1answer
447 views

Defend against Blind ROP

At IEEE Security & Privacy, the blind return-oriented programming attack (blind ROP) was just introduced. In some sense, this is just another variation on ROP attacks -- but the blind ROP attack ...
9
votes
4answers
830 views

Why don't computers check whether there are memory contents in some memory space?

Buffer overflow occurs because it writes to memory spaces that are used by, or will be used by other parts of the program. Computer programs usually write to the memorylocation that has been ...
4
votes
1answer
315 views

How to find stack pointer for overflow bug?

I've read that stack usually starts in same address so the attacker may guess the starting point of the buffer to overflow. This is necessary to know this address to make the malicious code run. I ...
124
votes
7answers
18k views

Why are programs written in C and C++ so frequently vulnerable to overflow attacks?

When I look at the exploits from the past few years related to implementations, I see that quite a lot of them are from C or C++, and a lot of them are overflow attacks. Heartbleed was a buffer ...
41
votes
2answers
9k views

What is the most hardened set of options for GCC compiling C/C++?

What set of GCC options provide the best protection against memory corruption vulnerabilities such as Buffer Overflows, and Dangling Pointers? Does GCC provide any type of ROP chain mitigation? Are ...
37
votes
8answers
4k views

Should I bother teaching buffer overflows any more?

The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
6
votes
5answers
2k views

Suggested reading list: OS exploits

In computer security, my areas of interest include x86 processors, binary exploitation and reverse engineering. I'm also interested in the certain aspects of the minix and the linux kernel(memory ...
21
votes
2answers
6k views

How can vending machines be hacked? And how can I prevent it?

I am developing a vending machine and want to make it secure. In a comment to my previous question, @Polynomial said "Vending machines (and similar devices) can often be pwned via buffer overflows on ...
5
votes
2answers
868 views

On Hawkes' technique to bypass canaries

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force ...
0
votes
1answer
3k views

Stack buffer overflow confusion

I am trying to dig deeper into the nuts and bolts a stack buffer overflow using the classical NOP-sled technique. Reading some articles and watching videos brought me to a confusion which can be ...
9
votes
1answer
1k views

How does ASCII-Armoring help to prevent buffer-overflow attacks?

I was reading about return-to-libc attacks at Wikipedia. According to what I read and understood from the article, ASCII armoring means that binary data is converted into ASCII values by grouping ...
6
votes
3answers
703 views

What is a buffer overflow?

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly. It has also mentioned how certain bad programming practises involving memory can be "...
3
votes
2answers
207 views

How to overwrite ebp on stack alignment?

I want to exploit a simple program #include <stdio.h> #include <string.h> int main(int argc, char** argv) { char buf[128]; strcpy(buf, argv[1]); return 0; } The disassembly ...
3
votes
2answers
283 views

Problems with overflowing the return address on stack x86_64

To note before compiling the program I disabled ASLR via: $ sudo -i root@laptop:~# echo "0" > /proc/sys/kernel/randomize_va_space root@laptop:~# exit logout I then compiled the program via: ...
1
vote
0answers
38 views

Can you get infected by viewing an image? [duplicate]

Lets say I have an infected image by some malware, I double-click it and that triggers the default program that handles images to open it for viewing. Will this also trigger the malware inside the ...
0
votes
3answers
180 views

if Noscript is secure is that possible our system still compromise by crypto?

perhaps all of us use no-Script when we visit untrusted web pages to block all scripts plugins etc. but still there is something beside plain HTML codes that we don't block; SSL connection! in Https ...