Appsec Knowledge Base

BUFFER OVERFLOW

How hackers exploit a buffer overflow.

A buffer overflow is a common mistake made by software developers that can be used by attackers to gain access to a computer system. A buffer is a sequential section of memory that may contain anything from an array of integers to a string of characters. In a buffer overflow, more data is allocated to a fixed-length buffer than the buffer can accommodate. The extra data overflows into an adjacent memory space, overwriting or corrupting the data that already exists there. A system crash is a typical result, but a buffer overflow also presents opportunities for attackers to run arbitrary code or to use these coding errors to initiate malicious actions.

There are a variety of ways to prevent a buffer overflow, but the first step is always to identify where a potential buffer overflow may exist. That’s where on-demand application testing services from Veracode can help.

Preventing buffer overflow attacks with Veracode.

Veracode provides cloud-based application testing services that enable developers and organizations to deliver secure software more easily, effectively and affordably. Our services can be seamlessly integrated into agile development, waterfall software development and other methodologies, to test for vulnerabilities from inception through production. With Veracode, organizations can find flaws earlier in the development process when it’s easier more cost-effective two remediate them.

To identify buffer overflow errors in software, we offer a patented binary static application security testing technology, Veracode Static Analysis, that analyzes code that is written, purchased or assembled without requiring access to source code. Developers can submit code for review from the Veracode Application Security Platform and receive results quickly – usually within four hours. Results are highly accurate, helping to avoid false positives. And by prioritizing vulnerabilities based on severity, we enable developers to fix the most dangerous flaws first, with step-by-step guidance for remediation.

Additional testing services for identifying buffer overflowvulnerabilities.

Our comprehensive suite of testing services includes a variety of technologies for identifying buffer overflow flaws.

  • Veracode Greenlight is a solution that runs in the background of a developer’s integrated development environment to identify potential flaws as code is being written. Greenlight provides immediate alerts when a piece of code may allow a buffer overflow or when it includes vulnerabilities that may lead to breaches like CSRF attacks. Greenlight also provides remediation advice that helps developers learn to write more secure code.
  • Veracode Web Application Scanning is a service that helps to identify and secure web applications through static and dynamic analysis.

Learn more about buffer overflow flaws in Veracode, or visit Veracode’s AppSec knowledge base to get answers to questions like “What is sequel injection?” and “What is a worm?”

 

 

contact menu