DefenseCode

Buffer Overflow

Risk type:MEDIUM

Description:

Buffer overflow occurs when a program attempts to write more data into a buffer than it can hold, or when a program attempts to put data in a memory area past buffer. Such conditions could be used by an attacker to cause program malfunctions or even to execute his own programs (or lines of code). Buffer overflow vulnerabilities are usually found in programs written in C and C++ programming language.

Example:

One of the most basic examples of buffer overflow:

void bufferoverflow(char *s) {
char buffer[4]; // buffer can contain 4 bytes
strcpy(buffer, s);
}
int main(int argc, char **argv) {
bufferoverflow(argv[1]); // argument could be > 4 bytes
}

If the first main function's argument is greater than 4 bytes, everything from fifth byte will be written to memory adjacent to buffer.

Mitigation:

  • Write programs in programming language that performs automatic bounds checking.
  • Use abstraction library to abstract away risky APIs (avoid standard library functions which are not bounds checked).
  • Use compiler-based canary mechanisms (commercial or open source buffer overflow protection solutions).
  • Use preventive functionality at operation system level.

Further reading:

http://www.linuxjournal.com/article/6701
http://www.windowsecurity.com/articles/analysis_of_buffer_overflow_attacks.html