Detecting possible buffer overflow attacks in C program | |
| Author | Vuong Hoai Nam |
| Call Number | AIT Thesis no.CS-03-12 |
| Subject(s) | Buffer storage (Computer science) C (Computer program language) |
| Note | A thesis submitted in partial fulfillment of the requirements for the degree of Master of Engineering |
| Publisher | Asian Institute of Technology |
| Abstract | Buffer overflows are unintentional accesses to memory outside the intended object. In recent years, buffer overflow attacks have become the most prevalent techniques used to hack both remote and local computer systems. All the reason for such a profound spread of this kind of attack is that many software and operating systems are written in C language. C is inherently unsafe because array and pointer references are not automatically bounds-checked. Therefore, it is up to the programmers to do it themselves. Nonetheless, these security holes are often wrongly omitted or checked. In addition to its prevalence, this attack can cause the most serious problem to compromised systems. One solution to buffer overflow attacks is to statically detect possible vulnerabilities in C source codes before they are deployed. Much research has been done to solve this problem, however, in a subset of C features, which involves pointer, array of char, one-dimension array, pointer arithmetic statements, and standard C string functions. This thesis will examine the principles of unix/linux buffer overflow vulnerabilities. Then, it will survey the existing static methods of detecting buffer overflows, and propose a better method that accumulates a larger domain of problems involving arrays of pointers. Finally, a prototype is implemented based on the proposed method. |
| Year | 2003 |
| Type | Thesis |
| School | School of Engineering and Technology (SET) |
| Department | Department of Information and Communications Technologies (DICT) |
| Academic Program/FoS | Computer Science (CS) |
| Chairperson(s) | Phan Minh Dung |
| Examination Committee(s) | Haddawy, Peter;Guha, Sumanta |
| Scholarship Donor(s) | Petro Vietnam |
| Degree | Thesis (M.Eng.) - Asian Institute of Technology, 2003 |