Re: [Lit.] Buffer overruns
From: David Wagner (daw_at_taverner.cs.berkeley.edu)
Date: 01/29/05
- Next message: jstevh_at_msn.com: "Surrogate factoring, out of the box"
- Previous message: David Wagner: "Re: [Lit.] Buffer overruns"
- In reply to: Trevor L. Jackson, III: "Re: [Lit.] Buffer overruns"
- Next in thread: Trevor L. Jackson, III: "Re: [Lit.] Buffer overruns"
- Reply: Trevor L. Jackson, III: "Re: [Lit.] Buffer overruns"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 29 Jan 2005 20:07:40 +0000 (UTC)
Trevor L. Jackson, III wrote:
>David Wagner wrote:
>> foo(char *s) {
>> char dst[80];
>> if (strlen(s) > sizeof(dst))
>> abort();
>> strcpy(dst, s);
>> }
>> bar() {
>> char *s = read_string_from_network();
>> foo();
>> }
>> Do you see the security hole?
>
>I see the defect, but I do not see a security hole (except in the sense
>that any defect, no matter how tiny, could lead to an exploitable hole).
Understandable. This sort of defect can be exploited (in some cases,
depending on the circumstances), but the attack is by no means obvious.
The defect is that an attacker can cause you to write a single '\0'
byte one place past the end of 'dst'; an off-by-one bug. It sounds
hard to believe that an off-by-one bug could possibly be exploitable.
I know I believed for quite some time that off-by-one bugs like this
were very unlikely to be exploitable. But then I saw an exploit, and
realized I had been too trusting.
It turns out there have been cases -- in the wild, with real code --
of off-by-one bugs just like this being exploited to take over the app.
The exploit went something like this: if you're lucky with the stack
frame layout, that '\0' overwrites the low byte of the frame pointer.
If the code in that procedure later uses the frame pointer in the wrong
way, it is going to be reading from or writing to the wrong place (the
address is off by up to 256 positions). This is just enough of a foot
in the door to do horrible things. If I recall, the attack may have only
worked on big-endian (or was that only on little-endian?) architectures.
I've forgotten the reference, but a Google search would probably turn
it up. If you're really curious, I may be able to dig up an example or
two from my archives.
Sometimes it seems like you just can't be too paranoid in this business.
- Next message: jstevh_at_msn.com: "Surrogate factoring, out of the box"
- Previous message: David Wagner: "Re: [Lit.] Buffer overruns"
- In reply to: Trevor L. Jackson, III: "Re: [Lit.] Buffer overruns"
- Next in thread: Trevor L. Jackson, III: "Re: [Lit.] Buffer overruns"
- Reply: Trevor L. Jackson, III: "Re: [Lit.] Buffer overruns"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
