A dynamic technique for eliminating buffer overflow vulnerabilities (and other memory errors)
Buffer overflow vulnerabilities are caused by programming errors that allow an attacker to cause the program to write beyond the bounds of an allocated memory block to corrupt other data structures. The standard way to exploit a buffer overflow vulnerability involves a request that is too large for...
Uloženo v:
| Vydáno v: | 20th Annual Computer Security Applications Conference s. 82 - 90 |
|---|---|
| Hlavní autoři: | , , , , |
| Médium: | Konferenční příspěvek |
| Jazyk: | angličtina |
| Vydáno: |
IEEE
2004
|
| Témata: | |
| ISBN: | 9780769522524, 0769522521 |
| ISSN: | 1063-9527 |
| On-line přístup: | Získat plný text |
| Tagy: |
Přidat tag
Žádné tagy, Buďte první, kdo vytvoří štítek k tomuto záznamu!
|
| Abstract | Buffer overflow vulnerabilities are caused by programming errors that allow an attacker to cause the program to write beyond the bounds of an allocated memory block to corrupt other data structures. The standard way to exploit a buffer overflow vulnerability involves a request that is too large for the buffer intended to hold it. The buffer overflow error causes the program to write part of the request beyond the bounds of the buffer, corrupting the address space of the program and causing the program to execute injected code contained in the request. We have implemented a compiler that inserts dynamic checks into the generated code to detect all out of bounds memory accesses. When it detects an out of bounds write, it stores the value away in a hash table to return as the value for corresponding out of bounds reads. The net effect is to (conceptually) give each allocated memory block unbounded size and to eliminate out of bounds accesses as a programming error. We have acquired several widely used open source servers (Apache, Sendmail, Pine, Mutt, and Midnight Commander). With standard compilers, all of these servers are vulnerable to buffer overflow attacks as documented at security tracking Web sites. Our compiler eliminates these security vulnerabilities (as well as other memory errors). Our results show that our compiler enables the servers to execute successfully through buffer overflow attacks to continue to correctly service user requests without security vulnerabilities. |
|---|---|
| AbstractList | Buffer overflow vulnerabilities are caused by programming errors that allow an attacker to cause the program to write beyond the bounds of an allocated memory block to corrupt other data structures. The standard way to exploit a buffer overflow vulnerability involves a request that is too large for the buffer intended to hold it. The buffer overflow error causes the program to write part of the request beyond the bounds of the buffer, corrupting the address space of the program and causing the program to execute injected code contained in the request. We have implemented a compiler that inserts dynamic checks into the generated code to detect all out of bounds memory accesses. When it detects an out of bounds write, it stores the value away in a hash table to return as the value for corresponding out of bounds reads. The net effect is to (conceptually) give each allocated memory block unbounded size and to eliminate out of bounds accesses as a programming error. We have acquired several widely used open source servers (Apache, Sendmail, Pine, Mutt, and Midnight Commander). With standard compilers, all of these servers are vulnerable to buffer overflow attacks as documented at security tracking Web sites. Our compiler eliminates these security vulnerabilities (as well as other memory errors). Our results show that our compiler enables the servers to execute successfully through buffer overflow attacks to continue to correctly service user requests without security vulnerabilities. |
| Author | Rinard, M. Leu, T. Roy, D.M. Dumitran, D. Cadar, C. |
| Author_xml | – sequence: 1 givenname: M. surname: Rinard fullname: Rinard, M. organization: Comput. Sci. & Artificial Intelligence Lab., Massachusetts Univ., Cambridge, MA, USA – sequence: 2 givenname: C. surname: Cadar fullname: Cadar, C. organization: Comput. Sci. & Artificial Intelligence Lab., Massachusetts Univ., Cambridge, MA, USA – sequence: 3 givenname: D. surname: Dumitran fullname: Dumitran, D. organization: Comput. Sci. & Artificial Intelligence Lab., Massachusetts Univ., Cambridge, MA, USA – sequence: 4 givenname: D.M. surname: Roy fullname: Roy, D.M. organization: Comput. Sci. & Artificial Intelligence Lab., Massachusetts Univ., Cambridge, MA, USA – sequence: 5 givenname: T. surname: Leu fullname: Leu, T. organization: Comput. Sci. & Artificial Intelligence Lab., Massachusetts Univ., Cambridge, MA, USA |
| BookMark | eNotj8FLwzAYxQNOcJs7efSSox5a8yVt0hxLcSoMPLirjLT94iJtomk36X9vQU8_Hrz3eG9FFj54JOQGWArA9EP1VlYpZyxL-QXZaFUwJXXOec6zBVkCkyKZpboiq2H4ZAy0VrAk7yVtJ29619ARm6N33yekNkSKneudN6PzH7Q-WYuRhjNG24Ufej51HqOpXedGhwO9M76lYTzOnh77ECeKMYY43F-TS2u6ATf_XJP99nFfPSe716eXqtwlTrMxUdrAvFc3slAtNtrYFiQDo0BIAGuEblUjhcwUaJwhVT3_zFst6jnQZGJNbv9qHSIevqLrTZwOIJTiUIhfxc9UPQ |
| ContentType | Conference Proceeding |
| DBID | 6IE 6IL CBEJK RIE RIL |
| DOI | 10.1109/CSAC.2004.2 |
| DatabaseName | IEEE Electronic Library (IEL) Conference Proceedings IEEE Xplore POP ALL IEEE Xplore All Conference Proceedings IEEE Electronic Library (IEL) IEEE Proceedings Order Plans (POP All) 1998-Present |
| DatabaseTitleList | |
| Database_xml | – sequence: 1 dbid: RIE name: IEEE Electronic Library (IEL) url: https://ieeexplore.ieee.org/ sourceTypes: Publisher |
| DeliveryMethod | fulltext_linktorsrc |
| Discipline | Computer Science |
| EndPage | 90 |
| ExternalDocumentID | 1377218 |
| Genre | orig-research |
| GroupedDBID | 23M 29O 5VS 6IE 6IF 6IH 6IK 6IL 6IM 6IN AAJGR AAWTH ACGFS ADZIZ ALMA_UNASSIGNED_HOLDINGS APO AVWKF BEFXN BFFAM BGNUA BKEBE BPEOZ CBEJK CHZPO I07 IPLJI M43 OCL RIE RIL |
| ID | FETCH-LOGICAL-i90t-79a19789c687dec9afd1601a713611fa39d7c6364719e36467b2005d93b87dc43 |
| IEDL.DBID | RIE |
| ISBN | 9780769522524 0769522521 |
| ISSN | 1063-9527 |
| IngestDate | Tue Aug 26 18:24:29 EDT 2025 |
| IsPeerReviewed | false |
| IsScholarly | true |
| Language | English |
| LinkModel | DirectLink |
| MergedId | FETCHMERGED-LOGICAL-i90t-79a19789c687dec9afd1601a713611fa39d7c6364719e36467b2005d93b87dc43 |
| PageCount | 9 |
| ParticipantIDs | ieee_primary_1377218 |
| PublicationCentury | 2000 |
| PublicationDate | 20040000 |
| PublicationDateYYYYMMDD | 2004-01-01 |
| PublicationDate_xml | – year: 2004 text: 20040000 |
| PublicationDecade | 2000 |
| PublicationTitle | 20th Annual Computer Security Applications Conference |
| PublicationTitleAbbrev | CSAC |
| PublicationYear | 2004 |
| Publisher | IEEE |
| Publisher_xml | – name: IEEE |
| SSID | ssj0019971 ssj0000558104 |
| Score | 1.7802784 |
| Snippet | Buffer overflow vulnerabilities are caused by programming errors that allow an attacker to cause the program to write beyond the bounds of an allocated memory... |
| SourceID | ieee |
| SourceType | Publisher |
| StartPage | 82 |
| SubjectTerms | Artificial intelligence Buffer overflow Computer errors Computer languages Computer science Data structures Dynamic compiler Java Laboratories Programming profession |
| Title | A dynamic technique for eliminating buffer overflow vulnerabilities (and other memory errors) |
| URI | https://ieeexplore.ieee.org/document/1377218 |
| hasFullText | 1 |
| inHoldings | 1 |
| isFullTextHit | |
| isPrint | |
| link | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV1NS8NAFFza4sFT1Vb8Zg8eFEybbD4271iKxVMp2EMvUvYrUKiJpE3Ff-_bTVoRvHjKJhAILySTeZk3Q8h9KJlIQYbITcD3IpUwT2SR8WLNBAIskxK0C5vg02m6WMCsRZ4OszDGGCc-MwO7dP_ydaEq2yobWnc8hKQ2aXOe1LNah36KH8epoxbNHwSAmmwhBHsQM15TdlwxBKzGeWe_HzWDe4EPw_HraOxo44D9ClxxeDPp_u9KT0j_Z3CPzg6QdEpaJj8j3X1yA20e5B55G1FdR9HTg4krxc9XatYu5ctqoamsbHYKtRrPbF180l21thbVTk2L_Jo-iFxTN8BF361e94uasizKzWOfzCfP8_GL1wQteCvwtx4HEWA5QCUp10aByHSAPE0gf02CIBMhaK4SazQfgMFNwqXtRWkIJZ6govCcdPIiNxeEQmwUx4ryyODbQUoZaR-k4SyTQaoZvyQ9W6zlR22lsWzqdPX34WtyXAtlbMfjhnS2ZWVuyZHabVeb8s7d_2_vM6qZ |
| linkProvider | IEEE |
| linkToHtml | http://cvtisr.summon.serialssolutions.com/2.0.0/link/0/eLvHCXMwlV1NS8NAFFxqFfRUtRW_3YMHBdMmm4_NO5ZiqVhLwR56kbJfgUJtJG0q_nt3N2lE8OIpm0AgPJJM5mXeDEK3PicsBu5rbgKuE4iIOCwJlBNKwjTAEs5B2rAJOhrF0ymMa-ihmoVRSlnxmWqbpf2XL1ORm1ZZx7jjaUjaQbsmOauc1qo6Km4YxpZclP8QAAq6pUHYgZDQgrTrFdGQVXrvbPeDcnTPc6HTe-32LHFsk1-RKxZx-o3_Xeshav2M7uFxBUpHqKaWx6ixzW7A5aPcRG9dLIswelzZuGL9AYvVwuZ8GTU05rlJT8FG5Zks0k-8yRfGpNrqaTXDxndsKbEd4cLvRrH7hVWWpdnqvoUm_cdJb-CUUQvOHNy1Q4F5uhwgophKJYAl0tNMjWkGG3lewnyQVETGat4DpTcR5aYbJcHn-gQR-CeovkyX6hRhCJWguqI0UPr9wDkPpAtcUZJwL5aEnqGmKdbsozDTmJV1Ov_78A3aH0xehrPh0-j5Ah0UshnT_7hE9XWWqyu0Jzbr-Sq7tvfCNwd2reI |
| openUrl | ctx_ver=Z39.88-2004&ctx_enc=info%3Aofi%2Fenc%3AUTF-8&rfr_id=info%3Asid%2Fsummon.serialssolutions.com&rft_val_fmt=info%3Aofi%2Ffmt%3Akev%3Amtx%3Abook&rft.genre=proceeding&rft.title=20th+Annual+Computer+Security+Applications+Conference&rft.atitle=A+dynamic+technique+for+eliminating+buffer+overflow+vulnerabilities+%28and+other+memory+errors%29&rft.au=Rinard%2C+M.&rft.au=Cadar%2C+C.&rft.au=Dumitran%2C+D.&rft.au=Roy%2C+D.M.&rft.date=2004-01-01&rft.pub=IEEE&rft.isbn=9780769522524&rft.issn=1063-9527&rft.spage=82&rft.epage=90&rft_id=info:doi/10.1109%2FCSAC.2004.2&rft.externalDocID=1377218 |
| thumbnail_l | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/lc.gif&issn=1063-9527&client=summon |
| thumbnail_m | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/mc.gif&issn=1063-9527&client=summon |
| thumbnail_s | http://covers-cdn.summon.serialssolutions.com/index.aspx?isbn=/sc.gif&issn=1063-9527&client=summon |