Overflow Buffers |
Attack Pattern ID: 100 (Standard Attack Pattern Completeness: Complete) | Typical Severity: Very High | Status: Draft |
Summary
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attacker's choice.
Attack Execution Flow
The attacker identifies a buffer to target. Buffer regions are either allotted on the stack or the heap, and the exact nature of attack would vary depending on the location of the buffer
Next, the attacker identifies an injection vector to deliver the excessive content to the targeted buffer.
The attacker crafts the content to be injected. If the intent is to simply cause the software to crash, the content need only consist of an excessive quantity of random data. If the intent is to leverage the overflow for execution of arbitrary code, the attacker will craft a set of content that not only overflows the targeted buffer but does so in such a way that the overwritten return address is replaced with one of the attacker's choosing which points to code injected by the attacker.
The attacker injects the content into the targeted software.
Upon successful exploitation, the system either crashes or control of the program is returned to a location of the attacker's choice. This can result in execution of arbitrary code or escalated privileges, depending upon the exploited target.
Targeted software performs buffer operations.
Targeted software inadequately performs bounds-checking on buffer operations.
Attacker has the capability to influence the input to buffer operations.
Description
The most straightforward example is an application that reads in input from the user and stores it in an internal buffer but does not check that the size of the input data is less than or equal to the size of the buffer. If the user enters excessive length data, the buffer may overflow leading to the application crashing, or worse, enabling the user to cause execution of injected code.
Description
Many web servers enforce security in web applications through the use of filter plugins. An example is the SiteMinder plugin used for authentication. An overflow in such a plugin, possibly through a long URL or redirect parameter, can allow an attacker not only to bypass the security checks but also execute arbitrary code on the target web server in the context of the user that runs the web server process.
Skill or Knowledge Level: Low
In most cases, overflowing a buffer does not require advanced skills beyond the ability to notice an overflow and stuff an input variable with content.
Skill or Knowledge Level: High
In cases of directed overflows, where the motive is to divert the flow of the program or application as per the attacker's bidding, high level skills are required. This may involve detailed knowledge of the target system architecture and kernel.
None: Detecting and exploiting a buffer overflow does not require any resources beyond knowledge of and access to the target system.
The attacker sends in overtly long input in variables under his control. If the target system or application handles it gracefully, the attack becomes difficult. However, an error condition or a system crash point to a high likelihood of successful exploitation.
In cases where the attack is directed at a particular system or application, such as an operating system or a web server, the attacker can refer to system architecture and design documentation to figure out the exact point of injection and exploitation.
An attack designed to leverage a buffer overflow and redirect execution as per the attacker's bidding is fairly difficult to detect. An attack aimed solely at bringing the system down is usually preceded by a barrage of long inputs that make no sense. In either case, it is likely that the attacker would have resorted to a few hit-or-miss attempts that will be recorded in the system event logs, if they exist.
A buffer overflow attack itself is pretty difficult to obfuscate. There, however, exist fairly advanced techniques to ofuscate the payload, in order to bypass an intrusion detection system or filtering, either in the application or by means of an application firewall of some sorts.
Use a language or compiler that performs automatic bounds checking.
Use secure functions not vulnerable to buffer overflow.
If you have to use dangerous functions, make sure that you do boundary checking.
Compiler-based canary mechanisms such as StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete solution.
Use OS-level preventative functionality. Not a complete solution.
Utilize static source code analysis tools to identify potential buffer overflow weaknesses in the software.
User-controllable input. Usually, any input that a user can control is prone to exploitation by overflow.
Malicious content, such as an overtly long input string, system shellcode or commands, intended to cause a system crash and denial of service, or to escalate privilege or execute code that results in information disclosure or system compromise.
Denial of service, escalated privileges, execution of arbitrary code, including system commands and low-level assembly code.
CWE-ID | Weakness Name | Weakness Relationship Type |
---|---|---|
120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | Targeted |
119 | Failure to Constrain Operations within the Bounds of a Memory Buffer | Secondary |
131 | Incorrect Calculation of Buffer Size | Targeted |
129 | Improper Validation of Array Index | Targeted |
805 | Buffer Access with Incorrect Length Value | Targeted |
19 | Data Handling | Secondary |
680 | Integer Overflow to Buffer Overflow | Targeted |
Vulnerability ID | Relationship Description |
---|---|
CVE-2007-2139 | Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightStor ARCserve Media Server, as used in BrightStor ARCserve Backup 9.01 through 11.5 SP2, BrightStor Enterprise Backup 10.5, Server Protection Suite 2, and Business Protection Suite 2, allow remote attackers to execute arbitrary code via malformed RPC strings. |
CVE-2007-1910 | Buffer overflow in wwlib.dll in Microsoft Word 2007 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted document |
Nature | Type | ID | Name | Description | View(s) this relationship pertains to |
---|---|---|---|---|---|
CanPrecede | Attack Pattern | 24 | Filter Failure through Buffer Overflow | Mechanism of Attack1000 | |
ChildOf | Attack Pattern | 123 | Buffer Attacks | Mechanism of Attack (primary)1000 | |
ChildOf | Category | 340 | WASC Threat Classification 2.0 - WASC-07 - Buffer Overflow | WASC Threat Classification 2.0333 | |
ParentOf | Attack Pattern | 8 | Buffer Overflow in an API Call | Mechanism of Attack (primary)1000 | |
ParentOf | Attack Pattern | 9 | Buffer Overflow in Local Command-Line Utilities | Mechanism of Attack (primary)1000 | |
ParentOf | Attack Pattern | 10 | Buffer Overflow via Environment Variables | Mechanism of Attack (primary)1000 | |
ParentOf | Attack Pattern | 14 | Client-side Injection-induced Buffer Overflow | Mechanism of Attack (primary)1000 | |
CanFollow | Attack Pattern | 24 | Filter Failure through Buffer Overflow | Mechanism of Attack1000 | |
ParentOf | Attack Pattern | 42 | MIME Conversion | Mechanism of Attack (primary)1000 | |
ParentOf | Attack Pattern | 44 | Overflow Binary Resource File | Mechanism of Attack (primary)1000 | |
ParentOf | Attack Pattern | 45 | Buffer Overflow via Symbolic Links | Mechanism of Attack (primary)1000 | |
ParentOf | Attack Pattern | 46 | Overflow Variables and Tags | Mechanism of Attack (primary)1000 | |
ParentOf | Attack Pattern | 47 | Buffer Overflow via Parameter Expansion | Mechanism of Attack (primary)1000 | |
ParentOf | Attack Pattern | 67 | String Format Overflow in syslog() | Mechanism of Attack (primary)1000 | |
ParentOf | Attack Pattern | 256 | SOAP Array Overflow | Mechanism of Attack (primary)1000 |
All user-controllable input must be strictly validated for enforcement of length and semantic checks
All exception conditions (such as ArrayIndexOutOfBounds) in applications must be gracefully handled through use of available exception handling mechanisms.
All applications and processes must be run with minimum privileges necessary so as to avoid an escalation of privilege in case of a successful exploit.
Ensure that the Bounds of No Memory Region Are Violated
Never Use Unvalidated Input as Part of a Directive to any Internal Component
Architectural Paradigms | All |
---|---|
Frameworks | |
Platforms | All |
Languages | AJAX C C++ PERL PHP Ruby Visual Basic Other |