Buffer overflow: Difference between revisions
imported>Eric M Gearhart (Added External Links) |
imported>Eric M Gearhart (Added technical explanation section. I'll add an image of the stack too) |
||
| Line 8: | Line 8: | ||
| retrievedate=2007-04-09 | | retrievedate=2007-04-09 | ||
}}</ref> | }}</ref> | ||
==Technical Explanation== | |||
A software execution stack exists in many modern kernels, much like a stack of books. Parts of the stack are marked as data, and other parts are marked as being executable. By unexpectedly overwriting the parts of the stack marked executable with data, exploit code is executed in place of the regular flow of the program. This can achieve unexpected results, ranging anywhere from the program running crashing, the entire [[operating system]] crashing, or the code actually being executed. This simple concept has had profound implications in the annals of computer security. | |||
==External Links== | ==External Links== | ||
Revision as of 12:21, 9 April 2007
In computers and computer security, a buffer overflow occurs when more data than was expected is written to a memory buffer than was intended by a programmer.
This error is the most common type of Computer security flaw that is used to run code on a remote machine unintentionally.
Other names for this attack include "buffer overrun" and "Smashing the Stack," both of which describe the concept.[1]
Technical Explanation
A software execution stack exists in many modern kernels, much like a stack of books. Parts of the stack are marked as data, and other parts are marked as being executable. By unexpectedly overwriting the parts of the stack marked executable with data, exploit code is executed in place of the regular flow of the program. This can achieve unexpected results, ranging anywhere from the program running crashing, the entire operating system crashing, or the code actually being executed. This simple concept has had profound implications in the annals of computer security.
External Links
"Smashing the Stack for Fun and Profit" This article is a bit dated, but it covers in great technical detail this flaw