CAPEC-100 Overflow Buffers

Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an adversary. As a consequence, an adversary is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the adversaries' choice.

1. [Explore] [Identify target application] The adversary identifies a target application or program to perform the buffer overflow on. Adversaries often look for applications that accept user input and that perform manual memory management. 2. [Experiment] [Find injection vector] The adversary identifies an injection vector to deliver the excessive content to the targeted application's buffer. 3. [Experiment] [Craft overflow content] The adversary crafts the content to be injected. If the intent is to simply cause the software to crash, the content need only consist of an excessive quantity of random data. If the intent is to leverage the overflow for execution of arbitrary code, the adversary crafts the payload in such a way that the overwritten return address is replaced with one of the adversary's choosing. 4. [Exploit] [Overflow the buffer] Using the injection vector, the adversary injects the crafted overflow content into the buffer.

• Targeted software performs buffer operations. • Targeted software inadequately performs bounds-checking on buffer operations. • Adversary has the capability to influence the input to buffer operations.

• [Low] In most cases, overflowing a buffer does not require advanced skills beyond the ability to notice an overflow and stuff an input variable with content. • [High] In cases of directed overflows, where the motive is to divert the flow of the program or application as per the adversaries' bidding, high level skills are required. This may involve detailed knowledge of the target system architecture and kernel.

• Availability: Unreliable Execution • Confidentiality, Integrity, Availability: Execute Unauthorized Commands • Confidentiality, Access Control, Authorization: Gain Privileges

• Use a language or compiler that performs automatic bounds checking. • Use secure functions not vulnerable to buffer overflow. • If you have to use dangerous functions, make sure that you do boundary checking. • Compiler-based canary mechanisms such as StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete solution. • Use OS-level preventative functionality. Not a complete solution. • Utilize static source code analysis tools to identify potential buffer overflow weaknesses in the software.