Page 1481 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Application Attacks

In Chapter 20, you learned about the importance of utilizing solid
software engineering processes when developing operating systems
and applications. In the following sections, you’ll take a brief look at

some of the specific techniques attackers use to exploit vulnerabilities
left behind by sloppy coding practices.

Buffer Overflows

Buffer overflow vulnerabilities exist when a developer does not

properly validate user input to ensure that it is of an appropriate size.
Input that is too large can “overflow” a data structure to affect other
data stored in the computer’s memory. For example, if a web form has
a field that ties to a backend variable that allows 10 characters, but the
form processor does not verify the length of the input, the operating
system may try to simply write data past the end of the memory space

reserved for that variable, potentially corrupting other data stored in
memory. In the worst case, that data can be used to overwrite system
commands, allowing an attacker to exploit the buffer overflow
vulnerability to execute arbitrary commands on the server.

When creating software, developers must pay special attention to
variables that allow user input. Many programming languages do not
enforce size limits on variables intrinsically—they rely on the

programmer to perform this bounds checking in the code. This is an
inherent vulnerability because many programmers feel parameter
checking is an unnecessary burden that slows down the development
process. As a security practitioner, it’s your responsibility to ensure
that developers in your organization are aware of the risks posed by
buffer overflow vulnerabilities and that they take appropriate
measures to protect their code against this type of attack.

Anytime a program variable allows user input, the programmer should
take steps to ensure that each of the following conditions is met:

The user can’t enter a value longer than the size of any buffer that
will hold it (for example, a 10-letter word into a 5-letter string