Perhaps you have seen an advertisement or observed in real life a small child attempting to pour a glass of milk from a very full container. Given the difficulty of controlling a full container of milk, more often than not, the youngster continues pouring the liquid until it fills the glass and then spills out onto the counter.
When you hear the term buffer overflow you might think of it as being roughly analogous to that milk that has spilled onto the counter. However, the after affects of a buffer overflow on your computer can be much trickier to clean up than that wet liquid on the counter.
So, what exactly is a buffer overflow and how can it affect computer security?
Simply put, a buffer overflow can happen when a software component or module tries to place more data into a temporary storage area (known as a buffer) than it was designed to hold. An overflow can occur when a piece of software accepts input or when two software modules are exchanging data. When too much data is received the information overflows the buffer for that component or module and then spills over into adjacent buffers, often corrupting valid data held in those other buffers.
Buffer overflows are not a new phenomenon. In fact, buffer overflows are, in large part, a by-product of the C programming language, which has been around since the 1970s. The C language is a good performer and many individuals and businesses choose to write software in this language because it is both fast and powerful.
The C language does have downsides, however. For one thing, it does not have some of the safety features found in other programming languages. References to arrays and pointers are not checked and many of the language's string variable operations are unsafe. Programmers have to write code that checks for and handles potential buffer overflows--not an easy task. The result is that often these exception-handling routines do not work right or the programmer omits them altogether given time constraints.
Other programming languages, such as Perl and Java, are less susceptible to buffer overflows because they dynamically allocate space for variable operations. However, programmers using these languages still need to check for potential buffer overflows, particularly if their Perl or Java code 'talks to' another piece of code that might be susceptible to buffer overflows.
Buffer overflows would then seem to be the result of sloppy programming. But, someone with the right expertise can also exploit buffer overflows to wreak havoc on your system.
When software runs on your computer, it uses a return address in memory to keep track of what it should do next. When a software component or module receives too much information and it spills over the existing buffer, it can also overwrite the return address with information that points it back to data or executable code that is housed in the incoming program variables.
Thus, a carefully crafted buffer overflow exploit will then execute instructions provided by the attacker rather than the program code you expect. The attackers replacement code could read or alter files on your system, start up remote access to your machine, connect your PC to another system where a Trojan horse can then be downloaded onto your computer, or any one of a host of other bad behaviors.
Major applications affected
Regardless of operating system and application, today attacks that take advantage of buffer overflows account for nearly half of all security vulnerabilities. Back in 1988, one of the first major buffer overflow exploits took advantage of the finger daemon on Unix to distribute a worm to almost 6,000 computer systems.
Today, with millions of computers now interconnected via the Internet, a single buffer overflow exploit can seriously damage both a large number of business computing machines as well as home users. For example, in 2000, a buffer overflow attack in Microsoft Outlook and Outlook Express made it possible for the attacker to execute whatever code they wished on the recipient's computer.
People receiving the message containing this buffer overflow did not even need to open the message or an attachment to activate it. Malicious code in the e-mail header launched the attack as soon as the message was downloaded from the e-mail server. This type of attack is very difficult to secure systems against. Microsoft was able to deliver a patch that eliminates this particular buffer overflow.
However, there are many other operating system services and existing applications, including Outlook and Outlook Express, that remain susceptible to various different kinds of buffer overflow attacks. And, using buffer overflows as an attack vehicle is not limited to just Microsoft-based technologies. You can become the victim of a buffer overflow attack regardless of whether you are using Macintosh, Solaris, Linux, Windows, or any other combination of operating system and applications. What's more, existing firewall technology cannot stop many types of buffer overflow attacks.
Writers of buffer overflow exploits do quite often target Microsoft technologies given the imbalance in the current computing market. With the majority of systems using Microsoft technologies, buffer overflow exploits that are targeted at these technologies can usually inflict the greatest damage. Were the marketplace to become more evenly balanced and competitive, you can be sure that attackers would find ways to use buffer overflows to their advantage regardless of the technology involved.
