QuickStudy: Buffer Overflow
Computerworld - Can there be too much of a good thing? That's certainly true for computer input. Do an Internet search on the term buffer overflow, and you'll come up with hundreds of thousands of links, most related to security.
In the National Institute of Standards and Technology's ICAT index of computer vulnerabilities (http://icat.nist.gov ), six of the top 10 involve buffer overflows. In 1999, the now-defunct research firm Hurwitz Group Inc. named buffer overflow the No. 1 computer vulnerability. Four years later, it's still a major problem.
If you've ever poured a gallon of water into a pint-size pot, you know what overflow means -- water spills all around.
Inside a computer, something similar happens if you try to store too much data in a space designed for less. Input normally goes into a temporary storage area, called a buffer, whose length is defined in the program or the operating system.
Ideally, programs check data length and won't let you input an overlong data string. But most programs assume that data will always fit into the space assigned to it. Operating systems use buffers called stacks, where data is stored temporarily between operations. These, too, can overflow.
When a too-long data string goes into the buffer, any excess is written into the area of memory immediately following that reserved for the buffer -- which might be another data storage buffer, a pointer to the next instruction or another program's output area. Whatever is there is overwritten and destroyed.
That in itself is a problem. Just trashing a piece of data or set of instructions might cause a program or the operating system to crash. But much worse could happen. The extra bits might be interpreted as instructions and executed; they could do almost anything and would execute at the level of privilege (which could be root, the highest level) assigned to that particular memory area.
Buffer overflow results from a well-known, easily understood programming error. If a program doesn't check for overflow on each character and stop accepting data when its buffer is filled, a potential buffer overflow is waiting to happen. However, such checking has been regarded as unproductive overhead - when computers were less powerful and had less memory, there was some justification for not making such checks. Moore's Law has removed that excuse, but we're still running a lot of code written 10 or 20 years ago, even inside current releases of major applications.
Some programming languages are immune to buffer overflow: Perl automatically resizes arrays, and Ada95 detects and prevents buffer overflows. However, C -- the most widely used programming language today -- has no built-in bounds checking, and C programs often write past the end of a character array.
Also, the standard C library has many functions for copying or appending strings that do no boundary checking. C++ is slightly better but can still create buffer overflows.
Buffer overflow has become one of the preferred attack methods for writers of viruses and Trojan horse programs. Crackers are adept at finding programs where they can overfill buffers and trigger specific actions running under root privilege -- say, telling the computer to damage files, change data, disclose sensitive information or create a trapdoor access point.
In July 2000, it was discovered that Microsoft Outlook and Outlook Express let attackers compromise target computers simply by sending e-mail messages. No one even had to open a message; as soon as the user downloaded the message, message-header routines went into action - with unchecked buffers that could overflow and trigger code execution. Microsoft has since created a patch that eliminates the vulnerability.
Kay is a Computerworld contributing writer in Worcester, Mass. Contact him at firstname.lastname@example.org.
See additional Computerworld QuickStudies
- Editor's Note: Tips From Security Pros
- The Story So Far: IT Security
- Know Thy Users: Identity Management Done Right
- Opinion: Feeling Insecure About Databases
- Evaluate Outsourcing Partners
- Strengthen Security During Mergers
- Thwart Insider Abuse
- Privacy Protection, Step by Step
- Plug IM's Security Gaps
- Boost Your Security Career
- The Almanac: IT Security
- Buffer Overflow
- The Next Chapter: IT Security
- Thwarting attacks on Apache Web servers
- Tips for Securing Your Windows Operating System
- The Hacker's Wireless Toolbox Part 1
- How to defend against internal security threats
- Ten ways to defend against viruses
- Decoding Mobile Device Security
- Five ways to thwart threats to your network
- Secrets to the best passwords
- Social engineering: It's a matter of trust
- Five tips for effective patch management
- Security Basics: Where to Start
- Steps to a secure operating system
- WLAN chip sets open a new door to insecurity
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts