If someone finds a vulnerability like buffer overflow in a program such as Google Chrome or Mozilla Firefox running on a linux machine, are there any chances that this vulnerability will persist on Mac OS X or Windows running same program.


Yes, without a doubt all platforms will be affected. The exploit for memory corruption vulnerabilities will be very different depending on the operating system. Each platform will have its own ROP Chain, or other method of controlling the flow of execution.

Vulnerabilities like Directory Traversal, SQL Injection, XSS, code eval()'s ect will almost certainly have an identical exploit regardless of operating system. In the context of web browsers, violations in the Same-Origin Policy, content separation, and some information disclosure vulnerabilities will likely have an identical exploit.

For example here is an information disclosure exploit that affects all WebKit Browsers regardless of platform. Where as a this memory corruption exploit for WebKit is a DoS condition on all platforms, but the means for obtaining code execution is very platform specific.

| improve this answer | |

Buffer overflows might be specific to a given target architecture; on PC and PC-like machines, it is possible that a buffer overflow exists in 32-bit mode and not in 64-bit mode, and vice versa. A buffer overflow is a programming bug: the program tries to do something that is not possible (writing more data than possibly fits in a buffer), and certainly not foreseen by the programmer. The size of both the buffer and the data which can be attempted to be written into it may depend on the characteristics of the platform, hence the possible dependency. Some buffer overflows actually occur in system libraries which are misused by the application, in which case the problem may be specific to a given operating system, and not extend to other OS where the "same" application may run.

A bug is still a bug, though -- that it fails to be demonstrated on a given architecture just means that the programmer's luck just locally exceeded his sloppiness. Also, regardless of the points above, most buffer overflows are system neutral: they occur on every system and architecture where the offending code is compiled.

Things are not that clear for all kinds of vulnerabilities. E.g., applications on Unix-like systems (this includes Linux and MacOS, but not Windows) often need to create temporary files in the /tmp directory, and the creation can often be subverted into a write access anywhere, with a symbolic link, assuming that the attacker can run code on the same machine (under a different username) and can predict the temporary file name. Failure to use a random unpredictable name for the temporary file is a vulnerability that applications may have on MacOS, but which does not appear on Windows. This is just an example; I do not want to suggest that MacOS or Linux is less secure (or, for that matter, more secure either) than Windows.

It is still a fair bet that most vulnerabilities found in Web browsers will persist on all operating systems. Web browsers are more and more self-contained, and really look like OS-within-the-OS, so their vulnerabilities tend to be their own, quite independent of the external operating system.

On the other hand, exploitation of the vulnerabilities, i.e. turning the bug into arbitrary code execution or the like, can be very system-dependent. Some OS employ various techniques in order to make life harder on the attacker, such as address space layout randomization or non-executable stacks. The buffer overflow (if the vulnerability is a buffer overflow) is still there, but ease of escalating it into a successful attack can greatly vary for the same application, not only between operating systems, but also between versions or even configuration options of a given OS. There is no reliable general rule, except that vulnerabilities shall be tracked down and eliminated whenever possible.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.