QuickStudy: Buffer Overflow
Computerworld - Can there be too much of a good thing? That's certainly true for computer input. Do an Internet search on the term buffer overflow, and you'll come up with hundreds of thousands of links, most related to security.
In the National Institute of Standards and Technology's ICAT index of computer vulnerabilities (http://icat.nist.gov ), six of the top 10 involve buffer overflows. In 1999, the now-defunct research firm Hurwitz Group Inc. named buffer overflow the No. 1 computer vulnerability. Four years later, it's still a major problem.
If you've ever poured a gallon of water into a pint-size pot, you know what overflow means -- water spills all around.
Inside a computer, something similar happens if you try to store too much data in a space designed for less. Input normally goes into a temporary storage area, called a buffer, whose length is defined in the program or the operating system.
Ideally, programs check data length and won't let you input an overlong data string. But most programs assume that data will always fit into the space assigned to it. Operating systems use buffers called stacks, where data is stored temporarily between operations. These, too, can overflow.
When a too-long data string goes into the buffer, any excess is written into the area of memory immediately following that reserved for the buffer -- which might be another data storage buffer, a pointer to the next instruction or another program's output area. Whatever is there is overwritten and destroyed.
That in itself is a problem. Just trashing a piece of data or set of instructions might cause a program or the operating system to crash. But much worse could happen. The extra bits might be interpreted as instructions and executed; they could do almost anything and would execute at the level of privilege (which could be root, the highest level) assigned to that particular memory area.
Buffer overflow results from a well-known, easily understood programming error. If a program doesn't check for overflow on each character and stop accepting data when its buffer is filled, a potential buffer overflow is waiting to happen. However, such checking has been regarded as unproductive overhead - when computers were less powerful and had less memory, there was some justification for not making such checks. Moore's Law has removed that excuse, but we're still running a lot of code written 10 or 20 years ago, even inside current releases of major applications.
Some programming languages are immune to buffer overflow: Perl automatically resizes arrays, and Ada95 detects and prevents buffer overflows. However, C -- the most widely used programming language today -- has no built-in bounds checking, and C programs often write past the end of a character array.
Also, the standard C library has many functions for copying or appending strings that do no boundary checking. C++ is slightly better but can still create buffer overflows.
Buffer overflow has become one of the preferred attack methods for writers of viruses and Trojan horse programs. Crackers are adept at finding programs where they can overfill buffers and trigger specific actions running under root privilege -- say, telling the computer to damage files, change data, disclose sensitive information or create a trapdoor access point.
In July 2000, it was discovered that Microsoft Outlook and Outlook Express let attackers compromise target computers simply by sending e-mail messages. No one even had to open a message; as soon as the user downloaded the message, message-header routines went into action - with unchecked buffers that could overflow and trigger code execution. Microsoft has since created a patch that eliminates the vulnerability.
Kay is a Computerworld contributing writer in Worcester, Mass. Contact him at firstname.lastname@example.org.
See additional Computerworld QuickStudies
- Editor's Note: Tips From Security Pros
- The Story So Far: IT Security
- Know Thy Users: Identity Management Done Right
- Opinion: Feeling Insecure About Databases
- Evaluate Outsourcing Partners
- Strengthen Security During Mergers
- Thwart Insider Abuse
- Privacy Protection, Step by Step
- Plug IM's Security Gaps
- Boost Your Security Career
- The Almanac: IT Security
- Buffer Overflow
- The Next Chapter: IT Security
- Thwarting attacks on Apache Web servers
- Tips for Securing Your Windows Operating System
- The Hacker's Wireless Toolbox Part 1
- How to defend against internal security threats
- Ten ways to defend against viruses
- Decoding Mobile Device Security
- Five ways to thwart threats to your network
- Secrets to the best passwords
- Social engineering: It's a matter of trust
- Five tips for effective patch management
- Security Basics: Where to Start
- Steps to a secure operating system
- WLAN chip sets open a new door to insecurity
Read more about Security in Computerworld's Security Topic Center.
- EndPoint Interactive eGuide In this eGuide, Network World, Computerworld, and CIO examine two endpoint trends - BYOD and collaboration - and offer tips and advice on...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Live Webcast How to serve up a Grand Slam with a scalable IT Infrastructure for cloud, big data and advanced analytics Register today to attend this webcast, and see examples of how The U.S. Tennis Association, Wimbledon and U.S. Golf Association are using the...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Live Webcast IBM FlashSystem V840: Leveraging Software-Defined Flash to Drive Your Business With end-to-end, tightly integrated functionality and super-fast flash technology, products like IBM FlashSystem V840 Enterprise Performance Solution empower businesses to leverage the efficiency...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!