Skip to main content
Share Your Experience: Take the 2024 Developer Survey
74 votes
Accepted

Is there any security risk in not setting a maximum password length?

A limit is recommended simply to avoid exhausting resources on the server. Without a limit, an attacker could call the login endpoint with an extremely large password, say a gigabyte (let's ignore ...
Marc's user avatar
  • 4,301
71 votes
Accepted

Does a buffer overflow vulnerability always mean a code execution vulnerability?

No, a buffer overflow might: Be against a buffer on the heap not the stack. This might still lead to code execution but will be much more complicated to exploit. Be limited in size, so not able to ...
Douglas Leeder's user avatar
59 votes

How big is a canary word on Linux, typically?

Let's try it out! Here is a very simple example program. int test(int a) { return a; } Compile it with GCC and intercept the compilation at the assembly stage. (The -S flag will do this.) Rename ...
5gon12eder's user avatar
46 votes

Does a buffer overflow vulnerability always mean a code execution vulnerability?

Douglas gives a correct answer. Not all buffer overflows give code execution. However, I felt it was missing a very important caution. Even if a buffer overflow does not allow arbitrary code ...
Josiah's user avatar
  • 1,868
39 votes
Accepted

How are fat pointers a good protection?

Buffer overflows aren't about setting the pointer to point to another arbitrary address. A buffer overflow happens when an input causes your program to performs a seemingly-correct operation (e.g. "...
cloudfeet's user avatar
  • 2,558
29 votes
Accepted

Concept of Jump-Oriented-Programming (JOP)

A lot of your questions are duplicates here so I'll cover them very briefly. Suffice to say that all of this has been a decades-long arms race between exploit developers and OS / compiler developers. ...
Polynomial's user avatar
  • 135k
26 votes
Accepted

Is it possible to find a buffer overflow in WordPress?

As PHP does memory management and a lot of stuff by itself, finding a buffer overflow specifically in WordPress doesn't really make sense to me. Before discrediting that Penetration Tester, I'd ask ...
GxTruth's user avatar
  • 953
25 votes

How big is a canary word on Linux, typically?

As i can read in this page: Stack Smashing Protector The stack canary is native word sized and if chosen randomly, an attacker will have to guess the right value among 2^32 or 2^64 combinations
Fernando Sanchiz's user avatar
20 votes

How can buffer overflows be harmful in Android?

Let's take Stagefright for example, the media library written in C++ How overflows bypass assigned privileges is simple; C code can directly write to memory. It's your job as developer to make sure ...
J.A.K.'s user avatar
  • 4,853
20 votes

Is it possible to find a buffer overflow in WordPress?

It could be that he found a buffer overflow in PHP or glibc which can be exploited via Wordpress. For example, 3 years ago there was a hole in gethostbyname() which could be exploited via Wordpress. ...
Aria's user avatar
  • 2,701
17 votes
Accepted

How is the stack protection enforced in a binary?

On a linux box with an Intel CPU, lets say I compiled by binary with -fstack-protect-all. Since it is not explicitly stated, it will be assumed that this refers to ELF binaries compiled using GCC ...
julian's user avatar
  • 1,299
15 votes

Do high level languages allow for buffer / heap overflow?

"level" of a programming languages is not a particularly well-defined concept. C++ for example would generally be regarded as a higher-level language then C but it still leaves the user open ...
Peter Green's user avatar
  • 5,300
12 votes
Accepted

What is an example of arithmetic and buffer overflows in a php application?

Arithmetic Overflow You cannot have arithmetic overflows in PHP, at least not in the sense that the number wraps around, leading to a smaller result than expected (which is the kind that may have ...
tim's user avatar
  • 29.6k
12 votes
Accepted

Why JMP ESP instead of directly jumping into the stack

Your exploit payload ends up on the stack because you're overflowing a buffer on the stack, and this is how you gain control of the return address as well. ESP points directly to the start of your ...
Peter Cordes's user avatar
11 votes

Is there any security risk in not setting a maximum password length?

Passwords should be hashed/salted. In addition to possible DoS attack risk from GB-size passwords, OWASP recommends limiting the password length because: Some hashing algorithms such as Bcrypt have a ...
Kyle Fennell's user avatar
10 votes

If the stack grows downwards, how can a buffer overflow overwrite content above the variable?

If the stack grows downward, functions that are called later get stack frames at lower memory addresses. Also, the return address is pushed to the stack before space for local variables is reserved, ...
ilkkachu's user avatar
  • 2,165
10 votes
Accepted

Cloudbleed: is it actually important to change ALL passwords?

While Miao is right for the case of passwords, this vulnerability also makes oauth tokens compromised. If a Cloudflare-dependent site uses Oauth, you should make an extra step resetting your oauth ...
Rápli András's user avatar
9 votes
Accepted

Unable to overwrite EIP register

Your code is wrong: #include <stdio.h> int main(){ char *buffer[64]; gets(buffer); return 0; } The char *buffer[64] creates an array of pointers to chars. Try again with this: #...
Polynomial's user avatar
  • 135k
9 votes

How can buffer overflows be harmful in Android?

Let me paraphrase the op's question: Android have a user-id-based app-isolation model and how could overflow bypass that? The answer is you overflow the parts that are shared between the apps: ...
billc.cn's user avatar
  • 3,936
9 votes
Accepted

Why must a ret2libc attack follow the order "system(),exit(),command?

The ret2libc (and return oriented programming (ROP)) technique relies on overwriting the stack to create a new stack frame that calls the system function. This wikipedia article explains stack frames ...
wireghoul's user avatar
  • 5,959
9 votes
Accepted

Viewing the stack

Getting a dump of memory the simple way You can simply send your vulnerable process a SIGSEGV (kill -SEGV pid) and, if coredump is allowed (ulimit -c unlimited), you gonna get a nice core dump file ...
binarym's user avatar
  • 784
8 votes

Program exiting after executing int 0x80 instruction when running shellcode

If you are running this from the command line, and you are using the < to feed the shellcode from a file, the shell will immediately terminate when it reaches the end of input. If you want it to ...
lintile's user avatar
  • 81
6 votes
Accepted

Buffer Overflows - Memory Addresses

Yes and no. The memory addresses that you see from a process do not directly correspond to the physical (or even virtual) memory. One of the tasks of the kernel is to map the memory of each process ...
grochmal's user avatar
  • 5,877
6 votes
Accepted

Is it possible to exploit a server using an C library with a vulnerability?

If this library is set in root mode (but local user can execute), can someone write a C program to elevate the privileges to root? I'm assuming that you mean that the library is owned by root and can ...
Steffen Ullrich's user avatar
6 votes

Cloudbleed: is it actually important to change ALL passwords?

There is no reason to change any other password. The only scenario I can think of where it may be required is the following: An attacker learns a password to your mail service. Then, he/she uses the ...
MiaoHatola's user avatar
  • 2,294
6 votes
Accepted

Using (cat $file; cat) to run a simple BOF exploit

The first cat command feeds the input from in.txt to stdin of the program. The second cat command just reads from the current stdin and feeds it to the program, thus providing the one executing this ...
Steffen Ullrich's user avatar
6 votes

Is it possible to find a buffer overflow in WordPress?

As GxTruth mentioned, PHP does memory management. This means anything running on php is basically as secure against buffer overflows as php is (unless you're doing something really crazy). But php ...
Kallmanation's user avatar
  • 1,736
6 votes
Accepted

Why would legitimate programs have a `jmp esp` instruction?

The instruction jmp esp is encoded as FF E4. It’s not necessary to find an actual jmp instruction, just those bytes in the middle of any other code or data. This is the basis for return oriented ...
David's user avatar
  • 744
5 votes

If the stack grows downwards, how can a buffer overflow overwrite content above the variable?

The stack only grows downwards when something is allocated on it. On the other hand, reading off the end of an array means reading upwards in memory. Let's say the stack pointer says 0x1002. At this ...
Reid Rankin's user avatar
  • 1,092

Only top scored, non community-wiki answers of a minimum length are eligible