RE: Buffer Overflow

>>Could this minimize the possibility of occurrences of buffer overflows or other similar security holes? 

The only way to achieve this is (a) educate developers on the issues, (b) fix existing code and (c) write new code that has fewer, if ont zero, such defects.

Once you've done this, you compile with fancy compiler flags to add defenses (note, I say defenses, not fixes), and then turn the feature off to reduce your attack surface.

The best tool for building secure software is not a compiler - it's between your ears.


Cheers, Michael

[Writing Secure Code 2nd Edition] http://www.microsoft.com/mspress/books/5957.asp
[Protect Your PC] http://www.microsoft.com/protect
[Blog] http://blogs.gotdotnet.com/mikehow

-----Original Message-----
From: Preston, Tony [mailto:[email protected]] 
Sent: Wednesday, November 05, 2003 5:16 AM
To: [email protected]
Subject: RE: Buffer Overflow

The simple answer is no.   A buffer overflow would be where you have
something like:

 char buffer[32];
 ....
 gets(buffer);
 ....

The gets() function reads characters into the buffer from standard input.
There is no checks for buffer size.  It really should be replaced with a bit of code that does something like:

fgets(buffer, sizeof(buffer), stdin);

(and for good programming practice, you should check to make sure that the buffer was not filled, i.e. make sure the user did not enter more characters than the buffer will hold.

Because the gets() function does not check for the size, a user could overfill the buffer (hence buffer overflow) and "possibly" trash the stack in a way that will execute code that will allow the user to gain priviledge.


Tony Preston
Systems Engineer, AS&T Inc.
Division of L3 Corporation
(609) 485-0205 x 181


-----Original Message-----
From: pablo gietz [mailto:[email protected]]
Sent: Tuesday, November 04, 2003 1:53 PM
To: [email protected]
Subject: Buffer Overflow

Hi Secprogrammers

Here my stupid question.
If I compile my final build with the checkboxes:
- Range checking   ( Checks that array and string subscripts are within 
bounds. Corresponds to {$R}) .
- I/O checking    (Checks for I/O errors after every I/O call. 
Corresponds to {$I}.)
- Overflow checking   ( Checks overflow for integer operations. 
Corresponds to {$Q}.)

checked . Could this minimize the possibility of occurrences of buffer overflows or other similar security holes?


Thanks

-- 
Pablo A. C. Gietz
Jefe de Seguridad Informática
Nuevo Banco de Entre Ríos S.A.
Te.: 0343 - 4201351
Fax: 0343 - 4201329