How to prevent buffer overflow attacks

Read up on types of buffer overflow attacks, and learn secure coding best practices that prevent such vulnerabilities, as well as post-deployment steps to keep apps and websites safe.

Sharon Shea, Executive Editor

Published: 25 Mar 2020

Buffer overflow attacks can cause serious damage to an organization by enabling an attacker to assault an application and gain control of the corporate network.

These attacks are far from new -- the first documented buffer overflow attack was 1988's Morris worm. Yet, despite their longevity and well-known tactics, they can be difficult to defend against.

To successfully mitigate buffer overflow attacks, it is important to understand how they unfold. Read on to learn how they work and then identify best practices during software development and post-deployment that help stop a buffer overflow vulnerability from compromising your enterprise's network and applications.

What is a buffer overflow and how does it work?

A buffer is a temporary area for data storage. When the amount of allocated data exceeds the capacity of the buffer, the extra data will overflow -- hence the name buffer overflow. This may cause data to leak out into other buffers, which can then corrupt or overwrite their contents.

In a buffer overflow attack, a malicious actor exploits vulnerable software. There are two main types of buffer overflows. Heap-based overflow attacks, which are difficult to execute and less common, infiltrate an application by flooding the memory space reserved for a program. The more common stack-based buffer overflow attack exploits an application's stack, the memory space that stores user input.

Stack-based buffer overflow attack example — In a stack-based overflow attack, malicious code infiltrates the stack when legitimate data is displaced.

If a malicious actor sends more data to a buffer stack than it can hold, legitimate data may be displaced by malware that can damage files, change data or expose private information. This act of using an input string longer than the amount of space reserved causes a security hole. Hackers use scanning tools to find applications vulnerable to overflow and then trigger an attack. Once malicious code causes an overflow, the hacker executes the command by indicating a return address that points to the command. The buffer causes the application to crash partially, but it tries to recover by going to the return address that has been redirected to the malicious command by the hacker.

When the buffer overflow attack runs the command found at the new return address, the program thinks it is still running. This means the command prompt window that has been opened is running with the application's same set of executable permissions as the application that was compromised, enabling the hacker to gain full control of the OS.

Other types of buffer overflows include the following:

In an integer overflow attack, also known as arithmetic attack, an arithmetic operation results in an integer that is larger than the maximum integer size allowed by the programming language.
In a Unicode overflow attack, Unicode characters are sent to a buffer that expects ASCII (American Standard Code for Information Interchange) characters, causing an overflow.
With format string attacks, the input is read as a command by an application. For example, malicious code input with functions such as printf or sprintf, if not validated, can be executed.