Table 38 Buffer Overflow

Last Updated on Tue, 11 Jul 2023 | Network Security

Attack name

Buffer overflow

Class/subclass

Manipulate/application manipulation

Sample implementations

Critical application vulnerabilities; check http://www.cert.org for the latest

Historical examples: Morris worm

Prerequisites

Direct access

Pertinent vulnerability

Software

Typical use

Escalate privileges on target machine

Attack result

Increased access

Likely follow-up attack

Read and composite

OSI layers

7

Detection

IDS and application security

Protection

Application security

Detection difficulty

4

Ease of use

3

Frequency

5

Impact

5

Overall rating

45

Buffer overflows are the most common form of application vulnerability. In short, they occur when an application developer fails to do proper bounds checking with the memory addresses an application utilizes. For example, a typical program might expect 20 bytes of input from the user for a particular memory address. If the user instead sends 300 bytes, the application should drop the other 280 bytes. Unfortunately, if the application has a coding mistake, the 280 bytes can overrun other parts of memory and potentially execute code with the privileges of the original application. If the vulnerable application runs as root, for example, a successful buffer overflow attack usually results in the attacker gaining root privileges. For more detail on buffer overflows, refer to the seminal work on the subject: "Smashing the Stack for Fun and Profit" by Aleph One, which can be found at the following address: http://www.shmoo.com/phrack/Phrack49/p49-14.

Buffer overflow attacks earn the highest threat score of any attack in this book. This is primarily because of the damage they cause and the inability of most security technology to help. Most stateful firewalls, for example, permit or deny traffic at Layer 4. A web buffer overflow attack can be remotely launched by an attacker, and because port 80 traffic is permitted by the firewall, the attacker gets through and likely is successful. The sad part is that buffer overflow attacks have been known for years. However, there are just too many places that buffer overflow attacks can occur in today's complex code, and stopping every single one of them is almost impossible.

Continue reading here: Table 39 Web Application

Was this article helpful?

+2 0

Related Posts

Readers' Questions

  • brad
    What is buffer overrun?
    1 month ago
    • Buffer overrun occurs when a program tries to store more data into a buffer (memory area) than the buffer is allocated to hold. This buffer can be on the stack, heap, or a program-specific buffer. A buffer overrun can overwrite data in memory, corrupt the buffer, or cause the program to crash. If an attacker can cause a buffer overrun, they can take control of the program and potentially gain access to the system or other programs on the system.
    • Ulpu
      What is buffer overflow in cyber security?
      1 month ago
      • Buffer overflow is a common vulnerability in cybersecurity that occurs when a program or system attempts to store more data in a buffer (a temporary storage area) than it was designed to hold. This extra data can overwrite adjacent memory locations, which can lead to various security issues. When a buffer overflow occurs, an attacker can exploit this vulnerability by deliberately providing more data than the buffer can handle. By doing so, they can overwrite critical information stored in adjacent memory locations, such as return addresses or control data. This can lead to the execution of malicious code, allowing the attacker to gain unauthorized access, control the system, or inject and run their own code. Buffer overflows are a serious concern because they can lead to exploits that compromise the security of a system. To mitigate this vulnerability, developers should implement secure coding practices, such as input validation and proper parameter checking, to ensure that buffers are not overflowed. Additionally, security measures like address space layout randomization (ASLR) and stack canaries can help detect and prevent buffer overflow attacks.
      • Vigo
        How does a buffer overflow attack work?
        7 months ago
        • Buffer overflow attacks occur when a malicious actor attempts to fill a computer’s memory buffer with more data than it is designed to hold. When the buffer overflows, it can overwrite adjacent memory locations, corrupting or deleting important data, crashing the system, or executing malicious code. A buffer overflow attack works by sending malicious input to the target application, usually through a web form or other input field. The malicious input is crafted to fit the format that the application is expecting, but contains more data than the buffer is designed to hold. As the application attempts to process the input, the memory buffer becomes filled with the malicious data and overflows into adjacent memory locations. This can overwrite important system data or executable code, causing the application to crash or execute malicious code, depending on how it is written.
        • klaudia
          What is a buffer overflow attack?
          8 months ago
          • A buffer overflow attack is a type of cyber attack where an attacker sends more data to a computer application than the application can store in its memory buffer. This ultimately causes the application to crash and potentially allow the attacker to gain access to the computer system.
          • Angela
            What are buffer overflows?
            8 months ago
            • Buffer overflows are a type of software vulnerability that can occur when a program tries to write more data to a memory buffer than it can contain. This can cause the buffer to overflow, overwriting other data and corrupting or crashing the application. In some cases, buffer overflows can even allow attackers to execute malicious code.