What Programming Languages Are Vulnerable to Buffer Overflow Attacks?

A buffer overflow vulnerability occurs when you requite a program as well much data. The excess information corrupts nearby space in retentiveness and may alter other data. As a result, the programme might study an fault or behave differently. Such vulnerabilities are also called buffer overrun.

Some programming languages are more susceptible to buffer overflow issues, such equally C and C++. This is because these are low-level languages that rely on the programmer to allocate retention. Nigh common languages used on the web such equally PHP, Java, JavaScript or Python, are much less prone to buffer overflow exploits because they manage retention allocation on behalf of the developer. Still, they are not completely safe: some of them allow direct memory manipulation and they frequently use cadre functions that are written in C/C++.

Buffer overflow vulnerabilities are hard to find and exploit. They are also non equally common as other vulnerabilities. However, buffer overflow attacks may have very serious consequences. Such attacks often let the attacker gain shell admission and therefore full command of the operating system. Fifty-fifty if the attacker cannot gain shell admission, buffer overflow attacks may stop running programs and, as a event, cause a Denial of Service.

Types of Buffer Overflow Vulnerabilities

At that place are two main types of buffer overflow vulnerabilities: stack overflow and heap overflow.

In the instance of stack buffer overflows, the result applies to the stack, which is the retentivity space used by the operating system primarily to store local variables and function return addresses. The data on the stack is stored and retrieved in an organized style (last-in-first-out), the stack allocation is managed by the operating arrangement, and access to the stack is fast.

In the case of heap buffer overflows, the issue applies to the heap, which is the retentivity space used to store dynamic information. The amount of retention that needs to be reserved is decided at runtime and it is managed past the program, not the operating organization. Access to the heap is slower but the space on the heap is only express by the size of virtual memory.

How Does a Buffer Overflow Piece of work

In a uncomplicated program, you may want the user to enter an email address. Therefore, yous create a cord variable. You lot classify 64 bytes to the variable because y'all do non expect an email string to be longer than 64 characters. However, you trust the user input likewise much and do non check if the length of the entered string exceeds the size of the buffer.

As a result, the user enters 100 characters and the remaining 36 characters are stored in memory allocated to some other variable. This causes the value of that variable to change and the behavior of the program to change besides. In most cases, this leads to a elementary retentiveness segmentation error only it may have more serious consequences. To understand, how this may influence program execution, we shall assume that the vulnerability is a stack overflow and information technology appears in a C program.

A C plan uses the stack to store a set of data for every function. The gear up of data is called a stack frame and it includes the function identifier, values of local variables, and the return address. Hither is a elementary source code instance to explain how the stack works:

                main() {   int mv1;   int mv2;   func();  }  void func() {   int fv1;   int fv2; }                              

When you lot run the program, information technology starts with the master() function. The programme stores the values of the principal() function variables on the top of the stack (mv1 and mv2). Then the main() role calls the func() part and it stores the values of its variables on the acme of the stack (fv1 and fv2). When the func() function finishes running, the top of the stack is forgotten, the current function returns to main(), and the programme has access to mv1 and mv2 once more.

For this to exist possible, the program remembers the electric current position on the stack (stack pointer) and the memory location where it needs to return after the current function is finished (return address). The trick backside a stack overflow assault is to overwrite this render address so that the program jumps to the attacker'south malicious code.

The malicious content that the attacker sends to a faulty programme is ordinarily equanimous of three parts:

• A chain of bytes that correspond the NOP instruction
• A new return address that points to the NOP bytes
• Arbitrary code (usually a shellcode) located somewhere in the middle of the chain of NOP bytes

When the buffer overflow occurs in our example, it causes the program to jump to the chain of NOP bytes (instead of jumping dorsum to the main() function). The NOP bytes are ignored, and the program encounters the shellcode in the middle of them. The shellcode executes an operating organisation shell, giving the assailant total access to the system.

Here is a very uncomplicated case of a C program that is vulnerable to a stack overflow:

                main(int argc, char *argv[]) {   func(argv[ane]); }  void func(char *v) {    char buffer[ten];   strcpy(buffer, v); }                              

The strcpy function in the above example copies the command argument into the destination buffer variable without checking the string length. The program only allocates x bytes to the buffer string and therefore strcpy causes a buffer overflow. If nosotros compile this program as vulnprog, the following command-line call is harmless:

                $ vulnprog AAAAAAAAAA                              

Yet, the following call causes a buffer overflow:

                $ vulnprog AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA                              

How To Prevent a Buffer Overflow

Preventing buffer overflow errors in non much different than preventing many other vulnerabilities. Information technology all comes downwardly to distrusting user input. In the example of buffer overflow vulnerabilities, the programmer must check the input length before using whatsoever functions that might cause an overflow to happen.

All the same, to err is human and it is non uncommon for developers to forget this basic rule. Code reviewers might miss such errors as well. That is why the safest bones method in C is to avoid the following five dangerous functions that can lead to a buffer overflow vulnerability: printf, sprintf, strcat, strcpy, and gets.

Unfortunately, the base C language provides just one safety alternative: fgets (to be used instead of gets). Various platforms accept their non-standard implementations. For example, the Microsoft version of C includes sprintf_s, strcpy_s, and strcat_s. On Linux/UNIX systems, the best choice is to ban unsafe functions and enforce the use of the Rubber C Library.

You can also protect against buffer overflows by using an extension of a compiler that uses canaries. The canaries are special values that the compiler places on the stack between the location of the buffer and the location of command data. When a buffer overflow occurs, information technology is the canary that is corrupted commencement and this corruption can be immediately detected. There are many compiler extensions that employ canaries, for example, StackGuard and ProPolice.

Operating System Buffer Overflow Protection Mechanisms

For a buffer overflow to be possible, the assailant must know exactly where the buffer will be located in the computer memory. In the past, this was every bit unproblematic as running a debugger on the local computer and checking the memory addresses. Current operating systems make it much more difficult.

All mod operating systems include a protection mechanism called the address space layout randomization (ASLR). Thanks to this mechanism, the executable file may exist loaded into many different retentiveness locations. Therefore, the attacker cannot easily predict which retentivity address to bound to and many buffer overflow attack attempts fail.

Another technique that helps forbid buffer overflow attacks is executable space protection (on Windows: data execution prevention – DEP). Thanks to this technique, the attacker cannot execute lawmaking if it is located in the memory space assigned to the stack or heap and in some cases, also other areas. This makes information technology impossible to directly call a shellcode merely attackers may use avant-garde tricks such every bit return-oriented programming.

Yet, an attacker may effort to evade both these protection mechanisms on x86 architectures by using a ret2reg attack. What they need to practise is to find a module (DLL) that is not protected by ASLR or DEP. If they can find a JMP ESP instruction (jump to stack, byte combination \FF\E4) in that module, they can use the location of this instruction as the return address. The plan volition jump to this location, execute the jump education (JMP ESP), and spring to the electric current location of the stack, which is right subsequently the return accost (before the shellcode).

Detecting Web-Related Buffer Overflows

Web applications and web pages are rarely susceptible to buffer overflow vulnerabilities because they are non written in C or C++. Notwithstanding, these errors happen in underlying software such every bit web servers, web application servers, or interpreters.

The Acunetix spider web vulnerability scanner checks for such errors in web software and the integration with OpenVAS lets information technology aggrandize the list of checks to include network-related software. Have a demo and find out more about running scans against your spider web server.

Become the latest content on spider web security
in your inbox each week.

THE AUTHOR

Tomasz Andrzej Nidecki (likewise known as tonid) is a Technical Content Writer working for Acunetix. A journalist, translator, and technical author with 25 years of It experience, Tomasz has been the Managing Editor of the hakin9 IT Security magazine in its early years and used to run a major technical web log dedicated to email security.

carrasquilloseenteage.blogspot.com

Source: https://www.acunetix.com/blog/web-security-zone/what-is-buffer-overflow/