170

C and C++, contrary to most other languages, traditionally do not check for overflows. If the source code says to put 120 bytes in an 85-byte buffer, the CPU will happily do so. This is related to the fact that while C and C++ have a notion of array, this notion is compile-time only. At execution time, there are only pointers, so there is no runtime method ...


111

Imagine you have a list of people you owe money to. Also, you have a weird pen with built-in correction fluid, so that if you write something in a particular place, and then write something else, it erases the first thing you wrote. This is how computer memory works, which is a bit different from how writing normally works. You pay someone a $500 deposit ...


89

Canary Stack canaries work by modifying every function's prologue and epilogue regions to place and check a value on the stack respectively. As such, if a stack buffer is overwritten during a memory copy operation, the error is noticed before execution returns from the copy function. When this happens, an exception is raised, which is passed back up the ...


59

Let's try it out! Here is a very simple example program. int test(int a) { return a; } Compile it with GCC and intercept the compilation at the assembly stage. (The -S flag will do this.) Rename the assembly file (so it won't be overwritten) and compile again, this time also adding the -fstack-protector-all and -mstack-protector-guard=global flags. The ...


57

Note that there is some amount of circular reasoning involved: Security issues are frequently linked to C and C++. But how much of that is due to inherent weaknesses of these languages, and how much of it is because those are simply the languages most of the computer infrastructure is written in? C is intended to be "one step up from assembler". There is no ...


47

I don't code for gcc, so hopefully someone else can add to this, or correct me. I'll edit it with responses. Some of these will not work for all circumstances. -Wall -Wextra Turn on all warnings to help ensure the underlying code is secure. -Wconversion -Wsign-conversionWarn on unsign/sign conversion. -Wformat­-securityWarn about uses of format functions ...


38

Buffer overflows aren't about setting the pointer to point to another arbitrary address. A buffer overflow happens when an input causes your program to performs a seemingly-correct operation (e.g. "increment(): move the pointer forward 256 bytes") too many times, so that the pointer moves out of the intended data structure / array, and into another object. ...


37

Actually, "heartbleed" was not really a buffer overflow. To make things more "efficient", they put many smaller buffers into one big buffer. The big buffer contained data from various clients. The bug read bytes that it wasn't supposed to read, but it didn't actually read data outside that big buffer. A language that checked for buffer overflows wouldn't ...


29

When I wrote that comment, I was referring to vending machines in a generalised sense - including things like ticket machines as well as the obvious food-dispensing ones. I was specifically thinking about a model of ticket vending machine at a place I frequent, which has the following interfaces: Keypad Credit / debit card terminal RFID for contactless use ...


27

Canaries and other volatiles do not prevent the overflow; they just try to cope with the consequences of an overflow which has happened. The canary tries to detect the case of an overflow which overwrote the return address in a stack frame. DEP is one step further, it assumes that the return address has been overwritten and followed, and it restricts the ...


27

As PHP does memory management and a lot of stuff by itself, finding a buffer overflow specifically in WordPress doesn't really make sense to me. Before discrediting that Penetration Tester, I'd ask him/her for documentation of the finding in question. As he/she works for said client (sounds like it, correct me if I'm wrong), it's his/her job to report such ...


26

No. Most likely, you got that 64k limit from the Heartbleed bug, hovewer it is purely because in HTTPS Heartbeats the length field was 16 bits long. It doesn't mean that in your case your software will not have a buffer overflow reaching far further. So while yeah, this could add a tiny bit of security, you must always assume that buffer overflows can affect ...


25

First, as others have mentioned, C/C++ is sometimes characterized as a glorified macro assembler: it is meant to be "close to the iron", as a language for system-level programming. So for instance, the language allows me to declare an array of zero length as a placeholder when, in fact, it may represent a variable-length section in a data packet or the ...


24

As i can read in this page: Stack Smashing Protector The stack canary is native word sized and if chosen randomly, an attacker will have to guess the right value among 2^32 or 2^64 combinations


22

Your memory address 0xbffff880 is most likely non-executable, but only read/write. There are a couple of ways you can overcome this. If that is a stack address you can use -z execstack while compiling. This will essentially make the entire stack memory executable. For a more robust solution you can write the shellcode to call mprotect on the address you ...


22

String Termination Vulnerability Upon thinking about this more, using strncpy() is probably the most common way (that I can think of) that could create null termination errors. Since generally people think of the length of the buffer as not including \0. So you'll see something like the following: strncpy(a, "0123456789abcdef", sizeof(a)); Assuming that ...


20

It is mostly untrue. Using a compiler of a different version than the one used for the "mainstream" binary, or using it with different compilation flags, may result in a few things ordered differently, but chances are that most of the code elements will appear in the same order. Insofar as it changes anything with regards to buffer overflow leveraging, ...


20

Actually none of these languages would have prevented the bug, but they would have lessened the consequences. OpenSSL's code is doing something which, from the abstract machine point of view, is nonsensical: it reads more bytes from a buffer than there actually are in a buffer. With C, the read still "works" and returns whatever bytes lingered after the ...


20

Let's take Stagefright for example, the media library written in C++ How overflows bypass assigned privileges is simple; C code can directly write to memory. It's your job as developer to make sure what you put in fits, otherwise it will happily write over other instructions of the same privilege. Stagefright has a lot of privileges. And the information ...


20

It could be that he found a buffer overflow in PHP or glibc which can be exploited via Wordpress. For example, 3 years ago there was a hole in gethostbyname() which could be exploited via Wordpress. It is called the GHOST vulnerability. If you have a very old OS without updates as well as a very old Wordpress that could be true.


19

There is always something in memory. Each bit contains either a 0 or a 1 at all times. If the same space in memory is used for two different purposes, the computer (the compiler or the runtime system) can't tell: purposes are a human concept, not a machine concept. On most systems that you'd think of as computers nowadays (PCs, servers, mobile phones, ...


19

The best advise for avoiding buffer overflow bugs in C is to not use C in the first place. The design philosophy of the language was that whenever they had to choose between efficiency and safety, they picked efficiency. The result is a language which can be used to write very fast and memory-conserving programs, but unfortunately at the expense of security. ...


18

It is possible to have issues with printf(), by using as format string a user-provided argument, i.e. printf(arg) instead of printf("%s", arg). I have seen it done way too often. Since the caller did not push extra arguments, a string with some spurious % specifiers can be used to read whatever is on the stack, and with %n some values can be written to ...


17

As the question is given in the headline, "Does compiling from sources .. protect from buffer overflow attacks?", the answer is in general no. However, here is a guess at what your friend might have been thinking of: Current versions of the GNU C Compiler (GCC) can optionally use the GCC Stack-Smashing Protector when invoked with the -fstack-protector ...


17

If you consider the bug as reading out of bounds of the current structure, than this would probably have been prevented in other languages, because one does not have unbound access to memory and would need to implement these things differently. But I'd rather would classify this bug as missing validation of user input, e.g. it believes that the size sent in ...


16

environ is a pointer to pointer, as it has the type char **environ. You have to try something like: (gdb) x/s *((char **)environ) 0xbffff688: "SSH_AGENT_PID=2107" (gdb) x/s *((char **)environ+1) 0xbffff69b: "SHELL=/bin/bash"


16

Crash Course in Computer Architecture In an Intel x86 and x64 architectures there is something called the stack. This is essentially where everything to determine the execution path is stored. Parameters to functions, local variables, and return addresses are all stored on the stack. CPU registers keep track of where in the stack the program is executing....


15

The content of that array, is low level machine code that will execute the shell /bin/sh, if executed on the correct architecture. An attacker may be able to feed it as data to a program which will execute it as code because of a bug. It's commonly used to exploit buffer overflows. One of the core principle of software programming is the concept of sub ...


15

The idea of using up more space than you were given, and therefore spilling over into a different field is simple enough to visualize. But it probably isn't clear how this can lead to a bad guy running his own code. This is pretty simple to explain if you understand it well enough. Just make sure you hit on the important background. More or less in this ...


15

There are two things going on here: On x86 and x86-64 (and most other hardware), the stack grows from the top of memory downwards. Because of this, data used by a function (eg. the buffer you're overflowing) occurs at a lower address number than data used in calling the function (eg. the address to return to after the function is done, which you're trying ...


Only top voted, non community-wiki answers of a minimum length are eligible