, (denial of service, DoS). , , , .
, - . , iS-DOS ( ZX Spectrum) TR-DOS ( TR-DOS ).
|
|
[]
, , . , , , , . (-), , , . . , .
, , , . . " " ( x86), , , . . , " " ( ), (: ? , ).
, . . [?], , , .
, , , C++, . . .
, , Java Lisp, , . , , . Perl . , . Windows , , . DEP Windows XP SP2, OSsurance Anti-Execute.
[]
[]
, . . x86.
, , , . x86 ́ ( , ), , . , (DATA) (DATA) () , (NEWDATA) , :
(NEWDATA)(DATA)(DATA)(...)
, . , , , , :
(ADDR)(DATA)(DATA)(...)
, . , char a[10], :
(.a........)(ADDR)(DATA)(DATA)(...)
, , , RET. , , .
, 10- , , ( ). , , 14 , . , , , , .
, 10 , . , , . UNIX- .
. . , , , .
[]
/* overflow.c - */ #include <stdio.h> #include <string.h> int main(int argc, char *argv[]) { char buffer[10]; if (argc < 2) { fprintf(stderr, ": %s \n", argv[0]); return 1; } strcpy(buffer, argv[1]); return 0; }
. 9 . 10 , .
, Strncpy . , , , , , , , . , .
/* better.c - , */ #include <stdio.h> #include <string.h> #define BUFFER_SIZE 10 int main(int argc, char *argv[]) { char buffer[BUFFER_SIZE]; if (argc < 2) { fprintf(stderr, ": %s \n", argv[0]); return 1; } strncpy(buffer, argv[1], BUFFER_SIZE); return 0; }
[]
, , .
[]
() . , , No Operation (NOP NOOP), , NOP-. , , , . - , , - , .
[]
: StackGuard Stack-Smashing Protector ( ProPolice), gcc. gcc-4.1-stage2, SSP . Gentoo Linux OpenBSD SSP gcc.
, . , gcc , , , , Forth. , .
[] UNIX-
, . (ASLR) / . .
Linux, PaX exec-shield. . OpenBSD 3.3 , W^X, .
, Sparc Sun, Efficeon Transmeta, 64- AMD Intel , , NX. AMD NX ( . No eXecute), Intel XD ( . eXecute Disabled).
[] Windows
, Windows, , .
, DEP ( . Data Execution Prevention « »), Windows XP Windows Server 2003. DEP Intel AMD, 4 , 32- . . () NX. DEP , ( SEH-). DEP SEH-, .
, , Windows Server 2003. «» (. canary), . «» , , .
, , , ASLR.
[]
C++, . , , , . , .
[] .
[]
- ( )
- Windows.
- .
- Windows NT.
- IIS CodeRed
- Buffer Overflow Protection Solution for Microsoft Windows® Operating Systems (.)
- Hardware solutions, execute disabled, AMDs NX and Intels XD solutions (.)
- SANS: inside the buffer overflow attack (.)
- Insecure Programming by Example (.)
- Secure Programming for Linux and Unix HOWTO: Avoid Buffer Overflow (.)
- Secure programmer: Countering buffer overflows (.)
- Smashing The Stack For Fun And Profit, Phrack 49 by Aleph One (.)
- «Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade» (.) Stackguard .
- Buffer Overflows Demystified (.)
- Wired 11.07: Slammed! (.) Slammer
- «The Tao of Windows Buffer Overflow» (.)
[]
- The Better String Library (.) .
- Stack-Smashing Protector (.) GCC,
