EditWYSIWYGAttach PDF Raw View►More Actions▼More Actions


Name of copy:
You will be able to review the copied topic before saving

Delete topic... scans links in CBI_ComputerSecurity web only

Revision Date Username Comment
1207 Apr 2015 - 15:32ThomasMisa 
1105 Mar 2015 - 14:08sever408? 
1005 Mar 2015 - 14:05sever408? 
923 Feb 2015 - 12:20sever408? 
816 Nov 2014 - 17:02ThomasMisa 
716 Nov 2014 - 17:01ThomasMisa 
630 Oct 2014 - 17:59ThomasMisa 
530 May 2014 - 16:28ThomasMisa 
425 Feb 2014 - 10:05norqu036? 
311 Feb 2014 - 11:13norqu036? 
earlier first

Render style:     Context:

 History: r12 | r6 < r5 < r4 < r3
[X] Hide this message.
You are here: UMWiki>CBI_ComputerSecurity Web>Mechanisms>MechanismsBufferOverflow (revision 4)


Buffer Overflow

"A buffer overflow is the computing equivalent of trying to pour two liters of water into a one-liter pitcher: some water is going to spill out and make a mess."(1) A buffer overflow, sometimes called a buffer overrun, occurs when a program that is writing data to a buffer (a sequential section of memory) writes data past the buffer's boundary and into adjacent memory. The Multics operating system of the 1960s was particularly secure against such attacks due to a variety of checks built into the software and hardware of the system. Some computing languages, such as Pascal, C, and C++, do not require the programmer to pre-define the size of the buffer, which means that the compiler has no way to know the proper boundary of the buffer. Even in programming languages that do check such things, such as C#, Java, and Visual Basic, there is no way to check every single circumstance due to the heavy use of pointers in modern programming, as well as the practical limits of compilers. (2)

Overflows cause serious problems in some instances. When an overflow occurs, the damage it causes depends on what exactly is in the memory that gets overwritten. If the program overflows into either the user's data space or the user's program area, the consequences are limited solely to the user and to the program in question. If the space contained already-used data or an already-performed program instruction, there might be no detectable effect on the program. Errors or inaccuracies in the program could result, depending on the nature of the data overwritten.

In more serious cases, however, the program overflows into parts of the computer's memory that contain data or code for the operating system, causing errors in the operating system. Malicious persons sometimes seek to take advantage of this vulnerability, using it to place unauthorized instructions within the operating system. The operating system of a computer generally has much higher privileges than normal programs, so any malicious code masquerading as the operating system will have identical privileges. This allows the malicious programmer to gain control over the system. Because they are difficult to find buffer overflows are the target of many forms of malicious code, including the SQLSlammer worm (sometimes called the Sapphire worm).(3)



Topic revision: r4 - 25 Feb 2014 - 10:05:00 - norqu036
Signed in as lewi0740 (NicLewis) | Sign out
UMWiki UMWiki
Ideas, requests, problems regarding UMWiki? Send feedback