New answers tagged


If the cache length lets say is 10.1kb well then the memory block will look something like this (Lets say the whole block is 30kb [Notice the middle block is our PP cache]): |~~~~~9.95kb~~~~~|~~~~~~10.1kb~~~~~|~~~~~~9.95kb~~~~~~| Now lets use the exploit, our data will look like this (Notice we just ran over 9kb of the next segment!): |~~~~~9.95kb~~~~~|~~~...


The main problem with your code is that it inst vulnerable to a buffer overflow more than likely due to the compiler (are you using gcc?) replacinggets withfgets If you strace the above compiled code (with malicious input) you should see what I mean.


You did answer your own question already: Is this something exploited through vulnerabilities ... Buffer Overrun Buffer overflows are not intended behaviour, but indeed exploitable vulnerabilities. Browsers vendors will fix B.O. when they find it => they do protect from it. The problem is, as with all vulnerabilities, someone has to recognize ...


It probably helps a little, raising the bar and requiring a more sophisticated attack, but I wouldn't hang my security hat on this. The better way to think about it is that, in the worst case, they have the ability to add arbitrary code to your program. They can do anything that C code can do, including read/writes to files on your filesystem (ie reading ...

Top 50 recent answers are included