loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
20th Annual Computer Security Applications Conference (ACSAC'04)
A Dynamic Technique for Eliminating Buffer Overflow Vulnerabilities (and Other Memory Errors)
Tucson, Arizona
December 06-December 10
ISBN: 0-7695-2252-1
Martin Rinard, Massachusetts Institute of Technology, Cambridge, MA
Cristian Cadar, Massachusetts Institute of Technology, Cambridge, MA
Daniel Dumitran, Massachusetts Institute of Technology, Cambridge, MA
Daniel M. Roy, Massachusetts Institute of Technology, Cambridge, MA
Tudor Leu, Massachusetts Institute of Technology, Cambridge, MA
Buffer overflow vulnerabilities are caused by programming errors that allow an attacker to cause the program to write beyond the bounds of an allocated memory block to corrupt other data structures. The standard way to exploit a buffer overflow vulnerability involves a request that is too large for the buffer intended to hold it. The buffer overflow error causes the program to write part of the request beyond the bounds of the buffer, corrupting the address space of the program and causing the program to execute injected code contained in the request.
We have implemented a compiler that inserts dynamic checks into the generated code to detect all out of bounds memory accesses. When it detects an out of bounds write, it stores the value away in a hash table to return as the value for corresponding out of bounds reads. The net effect is to (conceptually) give each allocated memory block unbounded size and to eliminate out of bounds accesses as a programming error.
We have acquired several widely used open source servers (Apache, Sendmail, Pine, Mutt, and Midnight Commander). With standard compilers, all of these servers are vulnerable to buffer overflow attacks as documented at security tracking web sites. Our compiler eliminates these security vulnerabilities (as well as other memory errors). Our results show that our compiler enables the servers to execute successfully through buffer overflow attacks to continue to correctly service user requests without security vulnerabilities.
Citation:
Martin Rinard, Cristian Cadar, Daniel Dumitran, Daniel M. Roy, Tudor Leu, "A Dynamic Technique for Eliminating Buffer Overflow Vulnerabilities (and Other Memory Errors)," acsac, pp.82-90, 20th Annual Computer Security Applications Conference (ACSAC'04), 2004
Usage of this product signifies your acceptance of the Terms of Use.