GHI

In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly
where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites
adjacent memory locations.

Buffers are areas of memory set aside to hold data, often while moving it fro*m one section of a
program to another, or between programs. Buffer overflows can often be triggered by malformed inputs;
if one assumes all inputs will be smaller than a certain size and the buffer is created to be that
size, then an anomalous transaction that produces more data could cause it to write past the end of
the buffer. If this overwrites adjacent data or executable code, this may result in erratic program
behavior, including memory access errors, incorrect results, and crashes.

Buffer Overflow • A buffer overflow condition exists when a program attempts to put more data in
a buffer than it can hold or when a program attempts to put data in a memory area past a buffer.
In this case, a buffer is a sequential section of memory allocated to contain anything fro*m
a character string to an array of integers. Writing outside the bounds of a block of allocated memory
can corrupt data, crash the program, or cause the execution of malicious code. • Buffer overflow
is probably the best known form of software security vulnerability. Most software developers know
what a buffer overflow vulnerability is, but buffer overflow attacks against both legacy and newly-
developed applications are still quite common. Part of the problem is due to the wide variety of
ways buffer overflows can occur, and part is due to the error- prone techniques often used to prevent them.


Contd... • Exploiting a buffer overflow allows an attacker to control or crash the process
or to modify its internal variables. Buffer overflow always ranks high in the Common Weakness
Enumeration/SANS Top 25 Most Dangerous Software Errors and is specified as CWE-120 under the Common
Weakness Enumeration dictionary of weakness types. Despite being well understood, buffer overflows
continue to plague software fro*m vendors both large and small. • A buffer overflow can occur
inadvertently, but it can also be caused by a malicious actor sending carefully crafted input to
a program that then attempts to store the input in a buffer that isn't large enough for that input.
If the excess data is written to the adjacent buffer, it overwrites any data held there. If
the original data includes the exploited Function’s return pointer -- the address to which the process
should go next -- an attacker can set the new values to point to an address of his choosing. The attacker
usually sets the new values to point to a location where the exploit Payload has been positioned.
This alters the execution path of the process and effectively transfers control to the attacker's malicious code.