Buffer overflow

• Solutions:

  1. Better architecture

     • Memory pages contain stack should not be marked executable!

  2. Elimination of intrinsically unsafe functions like gets

     • BSD 4.4 implementation of gets is:

        char *gets(char *) {
          fprintf(stderr, "gets is unsafe.  Don't use it.\n");
          exit(1);
        }

3. Better understanding of buffer overflow conditions and risks

4. Better programming languages with run-time bounds checking

5. Network daemons should not run as root

• Nevertheless, these attacks continue to be common

Next

Copyright © 2005 M. J. Dominus