Quote:

---

Buffer Overflows

Buffer overflows have been the bain of users? existences for many years now.

Practically every Windows, Linux, MacOS, and other operating system or application exploit has been due to these types of issues. A buffer overflow occurs when a system accepts input from another source, such as server software accepting a malicious packet of data from a hacker, and then doesn?t
properly work with the data.

For example, if a server application is designed to accept 256 characters of input from a data stream, such as a form request from the Internet, but instead accepts as much as it can take, assuming the sender will only send 256 characters, a buffer overflow condition can exist. If the application does not trim the data stream to 256 characters, but instead just tries to cram what it received into a 256 character buffer, the rest of the characters received ?overflow? out of the data container and very possibly into executable space (or into other data variables), such as the application heap or system heap, enabling the code to run in the context of the application, which on many consumer machines is administrator-level (basically, the application can do anything).

So, if a malicious user sends 256 Xs, because they know that fills up the 256 character buffer, and then sends code after the string of buffer-filling characters, that code may very well execute, or at least affect other variables in the program. This is what happened with the Code Red vulnerability, Slammer, Nimda, and many, many others?holes in code that wasn?t checking constraints on data.

For all you programmers out there, you may be thinking this is only for those who code in ?unmanaged? languages, like C. Actually other languages can have secure coding issues, such as array bounds issues. Some managed languages also let you run unmanaged code if you flip the right compiler switch?so be careful, and be a safe programmer.

The exploit that enables you to downgrade 2.0 PSPs to 1.5 takes advantage of a known buffer overflow in the TIFF image viewing library that the 2.0 PSP software uses in its photo viewer.
TIFF viewing was a new feature introduced in firmware 2.0, so 1.0?1.52 users cannot take advantage of this hack.

Windows XP Service Pack 2 supports detection of buffer overflows, making sure user data doesn?t
invade the system heap. Even processor manufacturers such as AMD and Intel are building in
capabilities in their processors to mark data as ?No Execute,? so under no circumstances will the
processor execute ?NOX? data, even if a buffer overflow occurs.

---