Firstly, we must define what a buffer is. A buffer is an allocated section of memory which can hold anything from a string of characters to an array of integers. That being the case, a buffer overflow (or overrun) is what happens a buffer with a fixed-length receives more data than what it can handle. In this case, the extra data has to be stored somewhere and spills over into an adjacent space in memory which can corrupt or overwrite the data stored there. These overflows usually result in a system crash; however, they also create opportunities for an attacker to run some malicious code or manipulate coding errors. The success of these attacks are very high as most programming languages, such as C, C++, and Fortran are vulnerable to these types of attacks.

How they Work

An attacker utilizes buffer overflows to manipulate the execution path of an application by overwriting its memory. The overflowed data would contain malicious code to trigger specific actions which would, in effect, send new instructions to the application that could allow access to the system. The techniques involved these attacks are done by manipulating coding errors and they vary on the architecture and operating system of the targeted system. Typically, these coding errors are common application development mistakes such as failing to allocate large enough buffers or neglecting to check for overflow problems. C/C++ are programming languages which are particularly prone to these types of attacks as they do not have any built-in against the vulnerability.

In some cases, an attacker might utilize a buffer overflow to inject their malicious code into the corrupted space of memory and in other cases, they might simply take advantage of the corrupted memory. Consider this example for instance, where a program requires a user’s password to grant them root access to the application. If the user’s password is captured by the use of the gets() function in C/C++, an attacker could take advantage of the function by performing a buffer overflow as the function does not check for the array bounds. This means that despite the attacker could enter an incorrect password, the correct password to be compared to was overwritten and would allow the attacker access regardless.

Solutions

For starters, developers should avoid the use of standard library functions such as gets(), strcpy(), scanf(), and other functions which do not check the bounds of the entered value. Furthermore; they should also utilize the practice of extensively testing their code to ensure buffer overflow is not a vulnerability it suffers from. This would often lead to developers making a habit of using runtime level bounds-checking to ensure that any data written to a buffer is within limitations.

Veracode's cloud-based service is a tool which can also provide a solution as well to this problem. The tool notifies developers of numerous code exploits and errors, such as buffer overflow, within their program before attackers can take advantage of them. Its patented binary static application testing (SAST) technology is the only one like it which allows developers to fully scan and analyze all code without requiring access to the source code.