Buffer overflows: attacks and defenses for the vulnerability of the decade

Goal-oriented dynamic test generation

“…Unsurprisingly, buffer overflow vulnerabilities dominate in the area of remote network penetration vulnerabilities [42]. The reality is that there are millions of lines of code invested in existing operating systems and securitysensitive applications, and the vast majority of that code is written in C. For instance, the Java Virtual Machine (JVM) is also a C program, and one of the ways to attack a JVM is to conduct buffer overflow attacks to the JVM itself [44].…”

“…Considerable research effort has attempted to develop static analysis tools and check security vulnerabilities in real world software applications [31], [32], [42], [80], [135]. Empirical studies have been also carried out to evaluate proposed static analysis techniques and tools [42], [80].…”

Survey of Protections from Buffer-Overflow Attacks

“…The notable methods are StackGuard [6,32,33,34] and ProPolice [7]. StackGuard assumes that return addresses must not be modified after creation and hence puts a canary word adjacent to the return address.…”

A Lightweight Buffer Overflow Protection Mechanism with Failure-Oblivious Capability

“…Several techniques detect buffer overflow attacks by checking the integrity of control data (i.e., return address, frame pointers, etc) [3,11]. StackGuard [6,7] and ProPolice [9] place canary values between local buffers and control data on stacks to check if the control data was corrupted due to buffer overflow. StackSheild [13] and RAD [4] copy the return address into a global return stack so that they can check the integrity of the return address in the function epilog.…”

“…Numerous approaches have been proposed to detect buffer overflow attacks. Static analysis techniques [1,2] analyze the source code of the service programs to detect memory error problems while dynamic techniques [3][4][5][6][7][8][9][10][11][12][13] check data integrity during program execution. Although these techniques effectively detect attacks, they can not protect the processes from being compromised, and thus terminating the compromised processes is necessary to prevent further error propagation.…”