The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
3answers
487 views

Drive-by downlad VS buffer and stack overflow attacks

Today malware is mainly spread thanks to vulnerabilities exploited in browsers and their plugins. The attackers use JavaScript to target those vulnerabilities. Two examples of such attacks are ...
0
votes
1answer
59 views

Does glibc use canary checking to prevent heap buffer overflow?

Since canary is used by gcc to prevent stack overflow (e.g. -fstack-protector), I am wondering whether glibc uses canary-based approach to defend heap buffer overflow? For example, this paper proposes ...
4
votes
2answers
128 views

Heap canaries, to protect function pointers in heap objects

I'm wondering if anyone has previously proposed, evaluated, or deployed the following measure to harden systems against heap-based buffer overruns: basically, stack canaries, but applied before ...
1
vote
2answers
135 views

Heap spray against 64-bit processes - possible?

Are heap spray exploits possible, if the process we're attacking is a 64-bit process? Naively, it seems like the 64-bit address makes it difficult to mount a heap spray: to fill all (or a significant ...
3
votes
2answers
210 views

Heartbleed and heap management - Why user data and passwords are kept in memory?

If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
1
vote
2answers
80 views

What is the heapspray technique and how to use it as reliably as possible?

Can somebody explain the different steps to produce a heapspray attack (what are the needed vulnerabilities in the targeted software, what are the limitations of such technique, how to proceed, ...) ...
4
votes
3answers
450 views

Are stack & heap overflow exploits no longer effective?

Do all new OSes implement the no execute bit in order to overcome vulnerabilities that could be used to execute malicious code? for example, is it implemented in Win7? Does that mean that the ...
1
vote
1answer
337 views

Determining the target address in a heap overflow

For a heap overflow to occur and arbitrary code to be executed, the function free() performs the step : hdr->next->next->prev = hdr->next->prev I understand that the address of ...