Madhnw0rm.com - Information About Cyber Security Awareness: Buffer Overflow

<div dir="ltr" style="text-align: left;" trbidi="on">
Buffer Overflow 
 
In a buffer Over flow while writing data to a buffer, the buffer boundary is over run and adjacent memory is over written 
 
In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations. This is a special case of the violation of memory safety. 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvzEB-cHN5gm5iQTJWRGqFeat6c3Wo-uCxxdpJ5GKMLq-H0ydVnUSVWothnmASFF2nq2f3FMjCwl7xSq4_ckxAd8e038AUMTLC5XoAGtIcerZIU98OOUG1TfyREdQDebxpOAG698_abFfN/s1600/buffer+overflow.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="n computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program" border="0" height="245" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgvzEB-cHN5gm5iQTJWRGqFeat6c3Wo-uCxxdpJ5GKMLq-H0ydVnUSVWothnmASFF2nq2f3FMjCwl7xSq4_ckxAd8e038AUMTLC5XoAGtIcerZIU98OOUG1TfyREdQDebxpOAG698_abFfN/s400/buffer+overflow.JPG" title="buffer overflow" width="400" /></a></div>
 
 
A buffer overflow occurs when data written to a buffer also corrupts data values in memory addresses adjacent to the destination buffer due to insufficient bounds checking. This can occur when copying data from one buffer to another without first checking that the data fits within the destination buffer. 
 
 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnHEPnhwd7nq2r9nOglAAVD_e05xTKzKk9t808CzYP5Qjg_6V6iPqRFCSoAhnUL7lCJw65mMYjWcH9A5hU6d6Iw2Tz9_HXGH0_otG5f2MXjQP8hBlC8A-fN1vD2kyA0hyphenhypheneT13Qah0feEE-/s1600/buffer+over+flow.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="225" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnHEPnhwd7nq2r9nOglAAVD_e05xTKzKk9t808CzYP5Qjg_6V6iPqRFCSoAhnUL7lCJw65mMYjWcH9A5hU6d6Iw2Tz9_HXGH0_otG5f2MXjQP8hBlC8A-fN1vD2kyA0hyphenhypheneT13Qah0feEE-/s400/buffer+over+flow.jpg" width="400" /></a></div>
 
 a program has two data items which are adjacent in memory: an 8-byte-long string buffer 
 
EXPLOITATION 
 
The techniques to exploit a buffer overflow vulnerability vary by architecture, by operating system and by memory region. For example, exploitation on the <a class="mw-redirect" href="https://en.wikipedia.org/wiki/Dynamic_memory_allocation#Heap-based_memory_allocation" style="background: none rgb(255, 255, 255); color: #0b0080; line-height: 22.4px; text-decoration: none;" title="Dynamic memory allocation">heap</a> differs markedly from exploitation on the call stack. 
<h3 style="background: none rgb(255, 255, 255); border-bottom-style: none; line-height: 1.6; margin: 0.3em 0px 0px; overflow: hidden; padding-bottom: 0px; padding-top: 0.5em;">
<ol style="text-align: left;">
<li>Heap-based exploitation</li>
<li>Barriers to exploitation</li>
<li>Practicalities of exploitation</li>
</ol>
</h3>
 
 
<pre style="background-color: #f9f9f9; border: 1px solid rgb(221, 221, 221); line-height: 1.3em; padding: 1em; white-space: pre-wrap;">char A[8] = "";
unsigned short B = 1979;</pre>
<pre style="border: 1px solid rgb(221, 221, 221); line-height: 1.3em; padding: 1em; white-space: pre-wrap;">Initially, A contains nothing but zero bytes, and B contains the number 1979.</pre>
<pre style="background-color: #f9f9f9; border: 1px solid rgb(221, 221, 221); line-height: 1.3em; padding: 1em; white-space: pre-wrap;">strcpy</pre>
<pre style="border: 1px solid rgb(221, 221, 221); line-height: 1.3em; padding: 1em; white-space: pre-wrap;"><code style="border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 2px; border: 1px solid rgb(221, 221, 221); line-height: 22.4px; padding: 1px 4px; white-space: normal;"><code class="mw-highlight" dir="ltr" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; border-image-outset: initial; border-image-repeat: initial; border-image-slice: initial; border-image-source: initial; border-image-width: initial; border-radius: 2px; border: 0px; direction: ltr; padding: 0px; unicode-bidi: embed;">"excessive"</code></code> is 9 characters long and encodes to 10 bytes including the terminator, but A can take only 8 bytes. By failing to check the length of the string, it also overwrites the value of B:</pre>
<pre style="background-color: #f9f9f9; border: 1px solid rgb(221, 221, 221); line-height: 1.3em; padding: 1em; white-space: pre-wrap;"><pre style="border: 1px solid rgb(221, 221, 221); line-height: 1.3em; padding: 1em; white-space: pre-wrap;">strncpy(A, "excessive", sizeof(A));</pre>
</pre>
<pre style="border: 1px solid rgb(221, 221, 221); line-height: 1.3em; padding: 1em; text-align: justify; white-space: pre-wrap;">To prevent the buffer overflow from happening in this example, it would be best to replace the <tt style="line-height: 22.4px; white-space: normal;"><a class="mw-redirect" href="https://en.wikipedia.org/wiki/Strcpy" style="background-attachment: initial; background-clip: initial; background-image: none; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; text-decoration: none;" title="Strcpy">strcpy</a></tt> call with a <tt style="line-height: 22.4px; white-space: normal;"><a class="mw-redirect" href="https://en.wikipedia.org/wiki/Strncpy" style="background-attachment: initial; background-clip: initial; background-image: none; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; text-decoration: none;" title="Strncpy">strncpy</a></tt>, which takes the maximum capacity of A as an additional parameter and ensures that no more than this amount of data is written to A</pre>
</div>

Buffer Overflow

Buffer Overflow In a buffer Over flow while writing data to a buffer, the buffer boundary is over run and adjacent memory is over written...