7

"Traditional Way" could mean anything. I'm assuming you're referring to a buffer overflow where the return address is replaced with an attacker controlled address on the memory to execute artbitrary code. Yes, this is mitigated by the NX bit. But, no. This does not stop attackers from using other mechanisms such as Return oriented programming which uses ROP ...


5

Steps to Exploitation Finding the Vulnerability This is probably one of the hardest steps. There are various ways to find vulnerabilities, and none of them are quick and easy. This takes time normally on the order of months. But lets say you're doing this on your own so you write your own bad piece of code: 1 #include <stdio.h> 2 #include <...


4

As Ohnana also mentioned the way to request a formal CVE is through their intake form. https://cve.mitre.org/cve/request_id.html Details from a current snapshot of that website Main Methods Contact one of the officially recognized CVE Numbering Authorities (CNAs), which will then include a CVE Identifier number in its initial public announcement about ...


4

"Drive-by-download" refers to the behaviour of the malware: it will (attempt to) infect the user during normal interaction with a web page. Buffer and stack overflow, on the other hand, are two technics used to attack a vulnerable application. They are not limited to the web in any way. (any software that takes some form of input - i.e. all software - is ...


3

There are two distinct questions here: How easy is it to trigger the vulnerability? In other words, how easy is it to make the program do something it isn't supposed to do? How severe is the vulnerability? In other words, if you can trigger it, what can you do with it? The answer to the first question is: very easy. VLC is a video player, and you can ...


3

The reason why CVSS scores are high, even though an issue is difficult to exploit, is because CVSS ignores the likelihood of some things. For example, if an exploit requires the user to open a media file, it gets the attribute "User interaction required". An exploit that would require the user to ignore an explicit warning also gets the attribute "User ...


3

Getting a victim to open a file is a proven effective way to attack an organisation - phishing and social engineering work, very well. So assume that part of the attack is low effort if you or your organisation is a target. As regards anything that sounds like complex crafting of a payload, if it can be created it will. The market in attacks flows down from ...


3

First, a small clarification: Classic heap sprays never needed to fill the entire virtual address anyway. They only needed to fill enough of memory to cover the range of uncertainty you have for the address of whether the shellcode will be. Thus, 100MB or so were enough. The picture changed a lot with the advent of DEP, because one can no longer spray ...


2

One way to overcome the no execute bit is to use different overflow targets entirely. People focus too much on the shell code style overflow vulnerabilities, and ignore a large portion of the vulnerabilities that are out there. For example, you can overflow into other arrays and even strings. You don't need to corrupt the stack or heap state to exploit a ...


2

A great, in-depth resource on a buffer overflow attack is the Smashing the Stack tutorial by Aleph One. While stack overflow and heap overflow are subtly different, the techniques are similar/related. Felix "FX" Lindner writes an excellent article (2006) on The H Security which describes your exploit in depth. Condensed version below; strongly recommend ...


2

In C, when you are finished using memory on the heap, you free() it which makes it available for use elsewhere. free() doesn't clear/wipe the memory to all zeros, so the next caller who asks for that memory will get the memory with its sensitive contents still intact unless you explicitly zero it before calling free(). Programs also often implement their own ...


2

Peter(corelanc0d3r) - Corelan team has one of the best Buffer Overflow tutorials on the internet


2

Part of the problem has to do with what the memory layout looks like at program initialisation and what the memory layout looks like after it has been running for a while and you manage to get your buffer to overflow. You also have to contend with the 'works on my machine' issue. So at initialisation, all the environment variables will be loaded at the ...


2

Canaries within an object run into one practical problem: it changes the in-memory layout of these objects. This layout needs to be consistent when passed between, say, the program and libraries. If you passed a pointer of type struct whatever * from a program compiled with this instrumentation, to a library compiled without this instrumentation (but with ...


2

As someone already pointed out: Don't expect undefined behavior to be reproducible. That said, there are a lot of variables. Of course there are the obvious ones (like CPU architecture / 32 bit or 64 bit mode; exact versions of the OS or other software involved (like .NET); etc.) but there also are the more subtle ones. Like how much memory the process is ...


2

The problem is that you are adding the two integers before performing the length check. if (len1 + len2 > 256) {return -1} // length check If len1 and/or len2 are sufficiently large, the addition will overflow, and the length check may go through even though the len1 and/or len2 are too large. To be safe, you must check twice: if ((len1 > 256) || ...


2

With a stack overflow - if you just keep overflowing - you overflow first locals vars, then saved registers, then return address, then function arguments, then stuff further down the stack, maybe exception handlers, etc. Usually as an attacker you indeed use the overwritten return address to jump somewhere interesting. With a heap overflow you overflow ... ...


1

The video @schroeder linked too is great. Maybe you need a simpler explanation though. Data execution prevention is software or hardware that monitors the location of executable code in memory. It is useful because if you ran malicious code from a part of memory reserved for trusted programs, it would be harder to detect. Windows keeps track of memory to ...


1

A win for an attacker is a bit of a vague term. Depending on other safeguards you could possibly fill up memory and overflow the stack. Or you could initialize memory which might be used later with certain values. Or you could just make whatever entry is in this spot too big and make other code fail which relies on its size. Exploiting usually relies on a ...


1

Yes, this program contains a simple buffer overflow error, and is exploitable. fread() reads up to 300 bytes and writes them to pData, which has only 20 allocated bytes. The memory space immediately following pData, which will be overwritten, is in use by other parts of the code, just not your application's code. The part of the code that will be ...


1

Here are a couple exploits for remote heap overflows for some older Linux daemons. Unauthenticated remote root vulnerability in Samba 3.x - This describes the module for the setinfopolicy_heap exploit, which is included by default in metasploit. Remote heap overflow in OpenSSL < 0.9.6d - A fairly advanced exploit for its time (2002). Includes detailed ...


1

Depending upon the size of the chunk to be freed, chunks are held in different types of bins (linked lists): Unsorted bins Small bins Large bins You are suggested to look up the source code if you are interested in knowing how these bins are maintained. But something common among all these bins is that the lists are doubly-linked. So you were correct in ...


1

Here, the vulnerability does not talk about some program running on your machine. The problem is data being overwritten at the wrong place. You can find the details of the vulnerability here: http://blog.talosintel.com/2016/06/pdfium.html#more As mentioned in the webpage: If in the above call to opj_calloc, which is a calloc wrapper, numcomps value ...


1

There was some very carful algebra done on this site on the variables that manage a doubly linked list of addresses. Have you investigated the source code in for malloc.c and unlink to see that the code has not changed in some way? I believe you will find your problem in there.


1

A drive-by-download isn't an attack. It just means that the malware will be automatically downloaded and executed without the user doing anything (I.E. You only have to visit a site for you to be infected). It may well be delivered via a JS exploit. This differentiates it from user-initiated malware, where a website will trick you into downloading and ...


1

Glibc has some inherent capabilities at detecting overruns, and they can be activated with the environment variable MALLOC_CHECK_. See mcheck and mallopt for details. Trying it out on a 64-bit Ubuntu 14.04 system, it seems that when allocating many memory blocks, malloc() rounds up the requested size to the next multiple of 8, and uses 8 extra bytes. E.g., ...


1

A similar approach is function pointer encryption, similar to that used to protect malloc metadata. This is proposed in section 2.4 of "Protection Against Overflow Attacks" The book's analysis is favorable. There is also an older paper about this technique (and another one). However, as far as I know, this technique is not is active use. I have absolutely ...


1

Heap Spraying is more the distraction used to enable someone to perform the actual attack. It in itself does not compromise any security measure. It is typically used in conjunction with injected code which is the payload. Think of it as a no op sled.


1

Windows has had Data Execution Protection since XP SP 2, but it's not always enabled by default, and it can be disabled for specific applications. So, many stack cracking exploits will be blocked, but probably not all of them. As for "all news OSes", YMMV. It's better to ask about specific ones.


Only top voted, non community-wiki answers of a minimum length are eligible