Department of Science, University of the People

CS 3340: Written Assignment Unit 5

Sabrina Mcnair

March 06, 2024

Buffer Overflow Attacks and Vulnerabilities in Contemporary Computing

Abstract

This essay explores the prevalence and implications of buffer overflow attacks in the current

cybersecurity landscape. Buffer overflow vulnerabilities, a long-standing issue in software

development, continue to pose serious threats to applications. The paper discusses the nature

of buffer overflows, notable examples of attacks, statistical data supporting the significance

of the threat, and preventive measures. The analysis emphasizes the need for secure coding

practices, detection methodologies, and effective mitigation strategies to safeguard against

buffer overflow exploits.

Introduction

Buffer overflow vulnerabilities, rooted in programming languages like C and C++, remain a

persistent concern in the realm of cybersecurity (Welekwe, 2023). This essay aims to delve

into the contemporary scenario of buffer overflow attacks, assessing their severity and

proposing preventive measures.

Nature of Buffer Overflow

A buffer overflow occurs when a computer program writes data beyond the allocated capacity

of a buffer, leading to the corruption of adjacent data or even program crashes. The essay

employs an analogy of pouring more liquid into a container than it can hold to illustrate this
concept. For instance, a user inputting data longer than the allocated buffer space can trigger

a buffer overflow, compromising the application's integrity.

Prevalence and Significance

The essay highlights the significance of buffer overflow attacks by referencing recent

statistics (Welekwe, 2023). Notable examples of historical attacks, such as the Morris Worm,

SQL Slammer, Heartbleed, and more, underscore the lasting impact and potential severity of

buffer overflow vulnerabilities. The essay emphasizes the need for current and relevant

statistical data, ensuring the information remains up-to-date and reflective of the evolving

threat landscape.

Common Attack Tactics

Buffer overflow attacks manifest in two primary tactics: stack overflow and heap overflow.

Stack-based attacks occur when a program writes more data to a stack buffer than allocated,

leading to the corruption of adjacent data. Heap-based attacks involve overwriting data in the

heap, targeting the open memory pool.

Notable Examples of Buffer Overflow Attacks

The essay provides insights into historical buffer overflow attacks, such as the Morris Worm,

SQL Slammer, Heartbleed, Adobe Flash Player, and the WhatsApp VoIP vulnerability. These

examples illustrate the diverse range of applications susceptible to buffer overflows,

emphasizing the need for comprehensive security measures.

Detection and Prevention

The essay outlines approaches to detect and prevent buffer overflows, emphasizing the

importance of bounds checking and secure coding practices. Static and dynamic testing

methodologies, illustrated through examples like Checkmarx and Appknox, help identify
vulnerabilities during and after development. The significance of runtime protection

mechanisms, such as ASLR, Data Execution Prevention, and Structured Exception Handler

Overwrite Protection, is emphasized.

Programming Language Vulnerability

The vulnerability of programming languages like C and C++ to buffer overflow attacks is

discussed. While languages like Java and Python have built-in features to reduce the

likelihood of buffer overflows, the essay acknowledges the challenges of switching to entirely

different programming languages.

Conclusion

Buffer overflow vulnerabilities persist as a significant threat in contemporary computing.

This essay provides a comprehensive overview of the nature of buffer overflows, highlights

historical examples, and emphasizes the importance of detection and prevention strategies.

By incorporating secure coding practices, employing testing methodologies, and leveraging

runtime protections, organizations can build a robust defense against buffer overflow attacks

in the evolving cybersecurity landscape.

References

1. Welekwe, A. (2023, September 27). Buffer Overflow Attacks and Vulnerabilities.

Retrieved from https://www.comparitech.com/blog/information-security/buffer-overflow-

attacks-vulnerabilities/

2. Buffer Overflow. (n.d.). Fortinet. Retrieved from

https://www.fortinet.com/resources/cyberglossary/buffer-overflow#:~:text=A%20buffer

%20overflow%20attack%20typically,composition%20or%20size%20of%20data.
3. Buffer Overflow Attack. (n.d.). Imperva. Retrieved from

https://www.imperva.com/learn/application-security/buffer-overflow/