Buffer overflow and format string overflow vulnerabilities

Kyung Suk Lhee, Steve J. Chapin

Research output: Contribution to journalArticle

40 Scopus citations

Abstract

Buffer overflow vulnerabilities are among the most widespread of security problems. Numerous incidents of buffer overflow attacks have been reported and many solutions have been proposed, but a solution that is both complete and highly practical is yet to be found. Another kind of vulnerability called format string overflow has recently been found and although not as widespread as buffer overflow, format string overflow attacks are no less dangerous. This article surveys representative techniques of exploiting buffer overflow and format string overflow vulnerabilities and their currently available defensive measures. We also describe our buffer overflow detection technique that range checks the referenced buffers at run-time. We augment executable files with the type information of automatic buffers (local variables and parameters of functions) and static buffers (global variables in the data/bss section) and maintain the sizes of allocated heap buffers in order to detect an actual occurrence of buffer overflow. We describe a simple implementation with which we currently protect vulnerable copy functions in the C library.

Original languageEnglish (US)
Pages (from-to)423-460
Number of pages38
JournalSoftware - Practice and Experience
Volume33
Issue number5
DOIs
StatePublished - Apr 25 2003

Keywords

  • Array and pointer range checking
  • Buffer overflow
  • ELF
  • Format string overflow
  • Linux

ASJC Scopus subject areas

  • Software

Cite this