Buffer Overflow

Front 1

Buffer overflows

Back 1

Most common security vulnerability
Important ingredients:
program that suid to root
put root-grabbing code in address space
jump to that code

Front 2

3 regions of process memory (low to high memory address)

Back 2

text: includes program instructions, read only
data: static variables and heap memory
stack: ADT for function calls

Front 3

stack

Back 3

stack pointer points to top
bottom is fixed address
parameters pushed in reverse order
move toward low memory address

Front 4

stack picture (low to high memory address)

Back 4

local variables
sfp
ret
parameters

Front 5

to find overflows

Back 5

read source code
run service, attempt systematic crash, search core dump for given log tag
automated tools

Front 6

preventing overflows

Back 6

don't use strcpy, strcat, sprintf
type safe languages
non-executable stack
random stack location
run-time checks (random or terminator canaries)

Front 7

other types of attack

Back 7

integer overflow
letting user specify format string
return to libc overflow (let system call do work when buffer to small...)