What Is A Buffer Used For

Buffer Overflow

Russell Kay By

Contributing Writer, Computerworld |

Tin can in that location exist too much of a skillful affair? That's certainly true for calculator input. Do an Internet search on the term buffer overflow, and you'll come with hundreds of thousands of links, nigh related to security.

In the National Institute of Standards and Technology'due south ICAT index of computer vulnerabilities (http://icat.nist.gov ), six of the peak 10 involve buffer overflows. In 1999, the now-defunct research house Hurwitz Grouping Inc. named buffer overflow the No. 1 computer vulnerability. Four years later, it's nevertheless a major problem.

Computerworld
QuickStudies

If you've ever poured a gallon of h2o into a pint-size pot, you know what overflow ways -- water spills all around.

Inside a computer, something similar happens if yous effort to shop too much data in a space designed for less. Input normally goes into a temporary storage area, called a buffer, whose length is defined in the programme or the operating system.

Ideally, programs check data length and won't allow y'all input an overlong data string. Merely most programs assume that data will always fit into the space assigned to it. Operating systems utilize buffers chosen stacks, where data is stored temporarily between operations. These, as well, tin overflow.

When a too-long data string goes into the buffer, whatever excess is written into the area of retentivity immediately following that reserved for the buffer -- which might be another information storage buffer, a pointer to the adjacent pedagogy or some other program's output area. Whatever is there is overwritten and destroyed.

That in itself is a problem. Only trashing a piece of data or set of instructions might cause a programme or the operating system to crash. But much worse could happen. The actress $.25 might be interpreted equally instructions and executed; they could do almost anything and would execute at the level of privilege (which could be root, the highest level) assigned to that particular memory area.

Bad Programming

Buffer overflow results from a well-known, easily understood programming error. If a program doesn't check for overflow on each grapheme and stop accepting data when its buffer is filled, a potential buffer overflow is waiting to happen. Yet, such checking has been regarded as unproductive overhead - when computers were less powerful and had less retentivity, there was some justification for not making such checks. Moore'due south Police has removed that excuse, but we're still running a lot of code written 10 or 20 years ago, even inside current releases of major applications.

Some programming languages are immune to buffer overflow: Perl automatically resizes arrays, and Ada95 detects and prevents buffer overflows. Even so, C -- the most widely used programming language today -- has no congenital-in bounds checking, and C programs ofttimes write past the stop of a grapheme array.

Also, the standard C library has many functions for copying or appending strings that exercise no boundary checking. C++ is slightly better only can still create buffer overflows.

Cracker'due south Choice

Buffer overflow has become ane of the preferred attack methods for writers of viruses and Trojan horse programs. Crackers are good at finding programs where they tin overfill buffers and trigger specific deportment running nether root privilege -- say, telling the computer to impairment files, modify data, disembalm sensitive information or create a trapdoor access point.

In July 2000, it was discovered that Microsoft Outlook and Outlook Express permit attackers compromise target computers just by sending e-mail messages. No 1 even had to open up a message; as presently as the user downloaded the message, bulletin-header routines went into action - with unchecked buffers that could overflow and trigger code execution. Microsoft has since created a patch that eliminates the vulnerability.

Kay is a Computerworld contributing writer in Worcester, Mass. Contact him at russkay@charter.net.

Meet additional Computerworld QuickStudies

Tips From Security Experts

Stories in this written report: