Wednesday, March 3, 2010

Buffer overflows

buffer overrun is when a program allocates a block of memory of a certain length and then tries to stuff too much data into the buffer, with extra overflowing and overwriting possibly critical information crucial to the normal execution of the program. Consider the following source code:


  • When the source is compiled and turned into a program and the program is run, it will assign a block of memory 32 bytes long to hold the name string.
                #include              int main ( )             {              char name[31 ] ;              printf("Please type your name:  ");              gets(name) ;              printf("Hello, %s", name) ;              return 0; 
Buffer overflow will occur if you enter:
'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA    AAAAAAAAAAAAAAAAAA 
A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended to hold. Since buffers are created to contain a finite amount of data, the extra information - which has to go somewhere - can overflow into adjacent buffers, corrupting or overwriting the valid data held in them. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity.
In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, in effect sending new instructions to the attacked computer that could, for example, damage the user's files, change data, or disclose confidential information.
Buffer overflow attacks are said to have arisen because the C programming language supplied the framework, and poor programming practices supplied the vulnerability.
Once a programmer has found a buffer overflow situation, then it is necessary to create a buffer of hex characters that represent assembled code instructions. The programmer then creates a C program that executes the target program, overflows the buffer by inserting the hex code to be executed.

You may find details of a few known buffer overflow exploits at the URLs mentioned below:

Protection against Buffer Overflows

  • Buffer overflow vulnerabilities are inherent in code due to poor or no error checking.
  • General ways of protecting against buffer overflows:
    1. Close the port of service
    2. apply vendors patch or install the latest version of the software
    3. Filter specific traffic at the firewall
    4. Test key application
    5. Run software at the least privilege required

General ways of protecting against buffer overflows include:
  1. Close the port of service: Keep track of vulnerability reports from sources like CERT, bugtraq and take preventive measures such as blocking the port in question.
  2. Apply vendors patch or install the latest version of the software: The next step should be to apply hotfix or patches from a reliable source.
  3. Filter specific traffic at the firewall: All suspicious traffic should be routed at the perimeter itself.
  4. Test key application: Key applications should be tested for boundary conditions before being put into production.
  5. Run software at the least privilege required: No unnecessary privileges should be granted to users or applications. This is a best practice.

0 comments:

Post a Comment