Exam 10: Buffer Overflow

Shellcode has to be __________, which means it cannot contain any absolute address referring to itself.

Buffer overflow attacks are one of the most common attacks seen.

Stack buffer overflow attacks were first seen in the Aleph One Worm.

The _________ is typically located above the program code and global data and grows up in memory (while the sack grows down toward it).

_________ attacks can occur in a binary buffer copy when the programmer has included code to check the number of bytes being transferred, but due to a coding error, allows just one more byte to be copied than there is space available.

A consequence of a buffer overflow error is __________ .

Data is simply an array of _________ .

__________ defenses aim to harden programs to resist attacks in new programs.

An attacker can generally determine in advance exactly where thetargeted buffer will be located in the stack frame of the function inwhich it is defined.

The Packet Storm Web site includes a large collection of packaged shellcode, including code that can:

In 2003 the _________ exploited a buffer overflow in Microsoft SQL Server 2000.

To exploit any type of buffer overflow the attacker needs to identify abuffer overflow vulnerability in some program that can be triggeredusing externally sourced data under the attackers control.

A buffer _________ is a condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated, overwriting other information.

Shellcode must be able to run no matter where in memory it islocated.

Traditionally the function of __________ was to transfer control to a user command-line interpreter, which gave access to any program available on the system with the privileges of the attacked program.

__________ is one of the best known protection mechanisms that is a GCC compiler extension that inserts additional function entry and exit code.

An essential component of many buffer overflow attacks is the transfer of execution to code supplied by the attacker and often saved in the buffer being overflowed. This code is known as _________ .

The potential for a buffer overflow exists anywhere that data is copiedor merged into a buffer, where at least some of the data are read fromoutside the program.

Buffer overflow exploits are no longer a major source of concern tosecurity practitioners.

A stack buffer overflow is also referred to as ___________ .