Timeline for Are buffer overflows pretty much a thing of the past in 2020
Current License: CC BY-SA 4.0
17 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 25, 2020 at 6:38 | answer | added | Serge Ballesta | timeline score: 0 | |
| Sep 23, 2020 at 15:05 | comment | added | Mobutu Sese Seko Kuku Ngbendu | I would have to agree with @schroeder, there was a video presentation from Joe McCray on exploiting buffer overflows. In the presentation, vulnerability in software (he used for demonstration) wasn't some edge case programming, but something that anyone could implement by a mistake. It happens now, and probably will in year of 2040. | |
| Sep 23, 2020 at 6:44 | comment | added | schroeder♦ | I have explained the flaw in logic. And your "95%/100%" comments are meaningless. Nothing is ever 100% and even 5% is enough to cause serious concern. | |
| Sep 22, 2020 at 22:07 | comment | added | multithr3at3d | "operating systems force these protections" not necessarily, some protections must be enabled on a program-by program basis at compile time. | |
| Sep 22, 2020 at 22:01 | answer | added | multithr3at3d | timeline score: 4 | |
| Sep 22, 2020 at 21:08 | comment | added | Conor Mancone | Boothole is a buffer overflow vulnerability. We'll be fixing that for years | |
| Sep 22, 2020 at 20:52 | comment | added | Vision | Response to the last 2 answers. I understand that there may be a flaw in my logic. Please tell me where the flaw is then because i want to learn new things. That list proves nothing cause 95 percent not exploitable is not the same as a 100 percent, read the post again. But maybe i should delve into that list to learn. I dont want to start a long discussion but if my logic is flawed please tell me where the fault is i just want to learn | |
| Sep 22, 2020 at 20:01 | review | Close votes | |||
| Oct 1, 2020 at 3:06 | |||||
| Sep 22, 2020 at 19:59 | comment | added | LvB | @schroeder While I agree that the logic is flawed I can understand if when your new to it and just learned about all that great stuff we have that you might think “surely this is a fixed thing now”. Your list of mitre conclusively proofs that to be false but I still get the thought pattern. | |
| Sep 22, 2020 at 19:50 | comment | added | schroeder♦ | This is just bad logic: "because something should not have a reason to exist, then, therefore, it does not exist". If you wanted to know if there were BO vulns, you can search for that. Here is a list of buffer overflow vulnerabilities found in 2020: cve.mitre.org/cgi-bin/cvekey.cgi?keyword=buffer+overflow | |
| Sep 22, 2020 at 19:48 | history | edited | schroeder♦ | CC BY-SA 4.0 |
deleted 153 characters in body
|
| Sep 22, 2020 at 19:48 | answer | added | LvB | timeline score: 1 | |
| Sep 22, 2020 at 19:45 | comment | added | Steffen Ullrich | Your description of existing security mechanisms might reflect the user space of recent OS for server, desktop and mobile devices, but is far less applicable to OS kernel (including drivers) and smaller embedded systems. Also, running 20 year old software is not uncommon in industrial context, i.e. the terrible past is actually still present. But yes, buffer overflow is less used compared too all the other attacks. 20 years ago all the web based attacks did not matter that much as they do today. | |
| Sep 22, 2020 at 19:40 | comment | added | mti2935 | The Heartbleed bug was not so long ago (2014). While this was not a typical buffer overflow bug in the sense that the bug caused the program to overrun the buffer while writing to it, it was in fact a buffer overflow bug in that the bug caused the program to read past the end of the buffer. See stackoverflow.com/questions/23089964/… | |
| Sep 22, 2020 at 19:32 | answer | added | camp0 | timeline score: 0 | |
| Sep 22, 2020 at 19:25 | review | First posts | |||
| Sep 23, 2020 at 11:06 | |||||
| Sep 22, 2020 at 19:22 | history | asked | Vision | CC BY-SA 4.0 |