Detection and Prevention of Stack Buffer Overflow

2005

Software coding practices, in the interest of efficiency, often ignore to enforce strict bound checking on buffers, arrays and pointers. This results in software code that is more vulnerable to security intrusions exploiting buffer overflow vulnerabilities. Unfortunately, such attacks form the most common type of security threats to the computer and information systems, making it imperative to find efficient solutions for the buffer overflow vulnerabilities. Typically, an attacker is able to affect a successful intrusion by causing buffer overflow in the stack frame of a function call, thereby causing the valid return address to get overwritten by a malicious value. This allows the attacker to redirect the return from a function call to a malicious piece of code introduced by the attacker. Depending on the nature of the malicious code, the attacker is able to compromise availability, integrity, or confidentiality of a system. Researchers have suggested transforming the return address or even using an entirely separate stack for managing the return addresses. This paper describes a simple technique that ensures the integrity of the return address by pushing on the stack two copies of the return address, a transformed (or encrypted) return address value along with the original one. Before popping the return address, two return address values are compared to detect any malicious activity, thus preventing the exploitation of the stack based buffer overflow vulnerabilities. The proposed modification may be implemented at the CPU architecture level or by simple modification to the compiler's prologue and epilogue code.

JISR management and social sciences & economics, 2003

The focus of this Study is on providing an understanding of buffer overflows, the ways they are exploited, and ways to prevent attackers from abusing them. Although this problem has been around for decades, the devastating effects have been downplayed by the commercial organizations due to the fact that they require a lot of effort to trace and to fix. This has led to a flood of software on the market which claims to be secure, yet can be exploited by wily hackers. As our reliance on closed-source and proprietary systems increases, we have to face the facts that there could be a myriad of security vulnerabilities in the very tools we use to protect critical data. To be informed is to be better armed.

For the past several years Buffer Overflow attacks have been the main method of compromising a computing system's security. Many of these attacks have been devastatingly effective, allowing the attacker to attain administrator privileges on the attacked system. We review the anatomy of these attacks and the reasons why conventional methods of defense have been ineffective, and likely to remain so in the foreseeable future. Recently, however, several promising methods of defense have been proposed. We compare the strengths and weaknesses of these defense methods.

In computer world there are many types of input validation attacks, in which "Buffer Overflow Attacks" is one of the most important types of attacks. Buffer overflow attacks create more dangerous to handle. Buffer Overflow is an anomaly where a programmer writes a data in a buffer, that overruns boundary of the buffer and overwrites the adjacent memory. This give the result erratic program types, such as memory access error, wrong results, a crash or break the computer security. In this paper, we discuss the classification of buffer overflow according to the generation, and prevention techniques of buffer overflow vulnerabilities.

IRJET, 2020

Buffer overflows is one of the most common form of security vulnerability. It may lead to an anonymous Internet user to gain control (partial or total) of a server. Mitigating buffer overflow vulnerabilities we can reduce most of the serious security threats. In this paper, we survey the various types of buffer overflow vulnerabilities and attacks, and survey the various defensive measures that mitigate buffer overflow vulnerabilities.

Buffer Overflow attack has been considered as one of the important security breaches in modern software systems that has proven difficult to mitigate. This attack allows the attacker to get the administrative control of the root-privilege by using the buffer overflow techniques by overwriting on the address of a returned function, function pointer stored on the memory and overflow a buffer on the heap. In this paper, we present the different buffer overflow techniques used by the exploiters and the methodologies applied to mitigate the buffer overflow.

Procedia Computer Science, 2016

We address the particular cyber attack technique known as stack buffer overflow in GNU/Linux operating systems, which are widely used in HPC environments. The buffer overflow problem has been around for quite some time and continues to be an ever present issue. We develop a mechanism to successfully detect and react whenever a stack buffer overflow occurs. Our solution requires no compile-time support and so can be applied to any program, including legacy or closed source software for which the source code is not available. This makes it especially useful in HPC environments where given their complexity and scope of the computing system, incidents like overflows might be difficult to detect and react to accordingly.

IJARIIT, 2018

The invention of Computers, Information Technology and thence Internet has led humanity to a new era of revolution. We, as humans, have stored more data in the last 20 years than the whole of human history. In May 2018 Forbes announced that we have created 90% of data all data in the past two years. That describes the way information storage and usage is picking up the pace. But are our basic pillars of storing data and processing full proof and completely secure? Buffer Overflow is currently the most hostile vulnerability in the basics of information storage and processing of our computing technology. The paper discusses this vulnerability in thorough details. Ways systems are coping up with this and methods used to overcome this vulnerability present in the basics of our most important invention.

This paper presents a systematic solution to the persistent problem of buffer overflow attacks. Buffer overflow attacks gained notoriety in 1988 as part of the Morris Worm incident on the Internet. While it is fairly simple to fix individual buffer overflow vulnerabilities, buffer overflow attacks continue to this day. Hundreds of attacks have been discovered, and while most of the obvious vulnerabilities have now been patched, more sophisticated buffer overflow attacks continue to emerge.

Workshop on Evaluating and …, 2002

Buffer overflow attacks are the predominant threat tothe secure operation of network and in particular, Internetbasedapplications. Stack smashing is a common mode ofbuffer overflow attack for hijacking system control. Thispaper evaluates two architecture-based techniques to defendsystems against such attacks: (1) the split control anddata stack, and (2) secure return address stack (SRAS). Thesplit stack approach separates control and data stack