OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
NFR Wizards Archives: Re: Buffer Overruns

Re: Buffer Overruns

Subject: Re: Buffer Overruns
From: Steven M. Bellovin (smbresearch.att.com)
Date: Tue Dec 21 1999 - 09:05:15 CST

In message <E11zSbB-0000mB-00polaris.shore.net>, Vin McLellan writes:
> It there something in the emergence of a popular Internet, or some
>other timely aspect in the industry's evolution, that has brought to light
>the vulnerabilities associated with buffer overruns in recent years?
>
> Maybe some shift in program design or programming engineering
>practice? What left so many of these vulnerabilities unexposed and their
>risks unappreciated for so many years?
>
> Sometimes even in <ahem> widely distributed source code.

I think it's a combination of closing of some other holes, the growth of the
net in general (and hence more attackers and more targets), and the emergence
of canned toolkits for building such attacks. You no longer need to be an
assember language wizard to do it; you just take the snippets, and adjust a
few constants until it works.

I don't think that changes in practice have contributed much; if anything, the
emergence of C++ (with its built-in String class) should have helped. But too
many programmers write C using a C++ compiler, and C is a *lousy* language for
avoiding such attacks.

                --Steve Bellovin

This archive was generated by hypermail 2b27 : Tue Dec 21 1999 - 17:06:06 CST