Tag Info

Hot answers tagged

4

"Traditional Way" could mean anything. I'm assuming you're referring to a buffer overflow where the return address is replaced with an attacker controlled address on the memory to execute artbitrary code. Yes, this is mitigated by the NX bit. But, no. This does not stop attackers from using other mechanisms such as Return oriented programming which uses ROP ...


2

In C, when you are finished using memory on the heap, you free() it which makes it available for use elsewhere. free() doesn't clear/wipe the memory to all zeros, so the next caller who asks for that memory will get the memory with its sensitive contents still intact unless you explicitly zero it before calling free(). Programs also often implement their own ...


2

A great, in-depth resource on a buffer overflow attack is the Smashing the Stack tutorial by Aleph One. While stack overflow and heap overflow are subtly different, the techniques are similar/related. Felix "FX" Lindner writes an excellent article (2006) on The H Security which describes your exploit in depth. Condensed version below; strongly recommend ...


1

Windows has had Data Execution Protection since XP SP 2, but it's not always enabled by default, and it can be disabled for specific applications. So, many stack cracking exploits will be blocked, but probably not all of them. As for "all news OSes", YMMV. It's better to ask about specific ones.



Only top voted, non community-wiki answers of a minimum length are eligible