Perhaps you have seen an advertisement or observed in real life a small child attempting to pour a glass of milk from a very full container. Given the difficulty of controlling a full container of milk, more often than not, the youngster continues pouring the liquid until it fills the glass and then spills out onto the counter.

When you hear the term buffer overflow you might think of it as being roughly analogous to that milk that has spilled onto the counter. However, the after affects of a buffer overflow on your computer can be much trickier to clean up than that wet liquid on the counter.

So, what exactly is a buffer overflow and how can it affect computer security?

Simply put, a buffer overflow can happen when a software component or module tries to place more data into a temporary storage area (known as a buffer) than it was designed to hold. An overflow can occur when a piece of software accepts input or when two software modules are exchanging data. When too much data is received the information overflows the buffer for that component or module and then spills over into adjacent buffers, often corrupting valid data held in those other buffers.

Buffer overflows are not a new phenomenon. In fact, buffer overflows are, in large part, a by-product of the C programming language, which has been around since the 1970s. The C language is a good performer and many individuals and businesses choose to write software in this language because it is both fast and powerful.

The C language does have downsides, however. For one thing, it does not have some of the safety features found in other programming languages. References to arrays and pointers are not checked and many of the language's string variable operations are unsafe. Programmers have to write code that checks for and handles potential buffer overflows--not an easy task. The result is that often these exception-handling routines do not work right or the programmer omits them altogether given time constraints.

Other programming languages, such as Perl and Java, are less susceptible to buffer overflows because they dynamically allocate space for variable operations. However, programmers using these languages still need to check for potential buffer overflows, particularly if their Perl or Java code 'talks to' another piece of code that might be susceptible to buffer overflows.

Buffer overflows would then seem to be the result of sloppy programming. But, someone with the right expertise can also exploit buffer overflows to wreak havoc on your system.

When software runs on your computer, it uses a return address in memory to keep track of what it should do next. When a software component or module receives too much information and it spills over the existing buffer, it can also overwrite the return address with information that points it back to data or executable code that is housed in the incoming program variables.

Thus, a carefully crafted buffer overflow exploit will then execute instructions provided by the attacker rather than the program code you expect. The attackers replacement code could read or alter files on your system, start up remote access to your machine, connect your PC to another system where a Trojan horse can then be downloaded onto your computer, or any one of a host of other bad behaviors.

Major applications affected

Regardless of operating system and application, today attacks that take advantage of buffer overflows account for nearly half of all security vulnerabilities. Back in 1988, one of the first major buffer overflow exploits took advantage of the finger daemon on Unix to distribute a worm to almost 6,000 computer systems.

Today, with millions of computers now interconnected via the Internet, a single buffer overflow exploit can seriously damage both a large number of business computing machines as well as home users. For example, in 2000, a buffer overflow attack in Microsoft Outlook and Outlook Express made it possible for the attacker to execute whatever code they wished on the recipient's computer.

People receiving the message containing this buffer overflow did not even need to open the message or an attachment to activate it. Malicious code in the e-mail header launched the attack as soon as the message was downloaded from the e-mail server. This type of attack is very difficult to secure systems against. Microsoft was able to deliver a patch that eliminates this particular buffer overflow.

However, there are many other operating system services and existing applications, including Outlook and Outlook Express, that remain susceptible to various different kinds of buffer overflow attacks. And, using buffer overflows as an attack vehicle is not limited to just Microsoft-based technologies. You can become the victim of a buffer overflow attack regardless of whether you are using Macintosh, Solaris, Linux, Windows, or any other combination of operating system and applications. What's more, existing firewall technology cannot stop many types of buffer overflow attacks.

Writers of buffer overflow exploits do quite often target Microsoft technologies given the imbalance in the current computing market. With the majority of systems using Microsoft technologies, buffer overflow exploits that are targeted at these technologies can usually inflict the greatest damage. Were the marketplace to become more evenly balanced and competitive, you can be sure that attackers would find ways to use buffer overflows to their advantage regardless of the technology involved.

What can you do?

You can expect buffer overflow-based attacks to be a major source of security problems for many years to come. This is due to the large number of already deployed applications that do not validate buffer sizes. Short of re-writing all the programs on your own computer, what can you do to protect your home systems or business network?

There are actually several actions you can take that will prove helpful. First, examine all system services that are running on your computer. Administrative tools on most systems will help you locate this information. Disable or remove all system services that you don't need. If you need help to determine which services to eliminate, locate this information at the vendor site for the operating system that you are running.

Second, remove (or don't use) any application that you don't need. Limiting the number of applications will help you keep a better handle on security updates for your system.

Also, be sure that your e-mail client is configured to not allow automatic execution of software received over e-mail. Additionally, be very careful about what you download and where you download it from.

Next, consider using applications that are not so widely targeted by exploit authors. For example, if you are worried about the large number of exploits that target Microsoft's Internet Explorer browser and Outlook e-mail client, you might consider a switch to Mozilla (for browsing) and Eudora (for e-mail) as a way to reduce your exposure to buffer overflows.

There are two other action items that are perhaps the most important. The first of these is alerts monitoring and the second is the application of security patches. Most major vendors provide security information on their Web sites about recently discovered buffer overflows. In addition, most vendors also provide mailing lists to distribute this type of information. For example, if you use Red Hat Linux, you might sign up for their security mailing list so you can stay abreast of the latest exploits. These notifications usually also include information about how to obtain a patch to fix the problem.

You might also consider joining the CERT Coordination Center mailing list since it provides security information for multiple operating systems, services, and applications. Once you do become aware of a potential attack that involves your operating system or applications, apply patches to fix the problem as quickly as possible.

As long as there is code running on computers that does not check for buffer overflows, attackers will find a way to use these types of exploits to cause problems. As computer users, we must all remain vigilant to prevent our systems from being compromised.

Keep up to date on buffer overflow vulnerabilities and other security threats:

Apple's Security Incident Response

CERT Coordination Center

Debian Linux Security Information

Mac Buyer's Guide Security Alerts

Mandrake Linux Security Advisories

Microsoft Security and Privacy

Red Hat Linux Security Resource Center

SuSE Security Announcements