Talk:Stack buffer overflow: Difference between revisions

Content deleted Content added

Inline

Revision as of 01:11, 30 April 2016

This is the talk page for discussing improvements to the Stack buffer overflow article.
This is not a forum for general discussion of the article's subject.

Put new text under old text. Click here to start a new topic.
New to Wikipedia? Welcome! Learn to edit; get help.

Article policies

Find sources: Google (books · news · scholar · free images · WP refs) · FENS · JSTOR · TWL

Computer security: Computing Unassessed

This article is within the scope of WikiProject Computer security, a collaborative effort to improve the coverage of computer security on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.Computer securityWikipedia:WikiProject Computer securityTemplate:WikiProject Computer securityComputer security

???

This article has not yet received a rating on Wikipedia's content assessment scale.

???

This article has not yet received a rating on the project's importance scale.

This article is supported by WikiProject Computing.

Things you can help WikiProject Computer security with:

Article alerts will be generated shortly by AAlertBot. Please allow some days for processing. More information...

Review importance and quality of existing articles
Identify categories related to Computer Security
Tag related articles
Identify articles for creation (see also: Article requests)
Identify articles for improvement
Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc.
Find editors who have shown interest in this subject and ask them to take a look here.

A fact from Stack buffer overflow appeared on Wikipedia's Main Page in the Did you know column on 20 August 2007. The text of the entry was as follows:

Did you know... that causing a stack buffer overflow is one of the oldest and most reliable methods for hackers to gain unauthorized access to a computer?

A record of the entry may be seen at Wikipedia:Recent additions/2007/August.

Wikipedia

Unnamed section

The following phrase from the article is IMO suboptimal:

"This works because the execution never actually vectors to the stack itself.".

Even if "vectors" would be a verb that could be used that way (is it?), it feels very awkward to me. A more direct explanation without resorting to symbolisms would be better. Unfortunately I wasn't able to rephrase it in a more succint way :-/ —Preceding unsigned comment added by 193.247.120.15 (talk) 22:22, 11 September 2007 (UTC)[reply]

Still if used in conjunction with techniques like ASLR a nonexecutable stack can be somewhat resistant to return to libc attacks and thus can greatly improve the security of an application.

Given that ASLR protection has been shown to be effectively rendered useless in a few minutes (http://www.cse.ucsd.edu/~hovav/papers/sppgmb04.html), the above statement seems to be misleading -- Prashmohan 10:35, 31 October 2007 (UTC)[reply]

The example code actually uses the second command line argument to the program since arrays in C are zero based and the index 1 is used. —Preceding unsigned comment added by Gthubron (talk • contribs) 19:39, 8 April 2008 (UTC)[reply]

WARNING: In the images describing stack, in my opinion char *bar should be below return address (feel free to update images). bar* is pushed before call, so RET adress is "above". —Preceding unsigned comment added by 91.135.176.215 (talk) 13:49, 5 January 2009 (UTC) I agree, bar* is definitely pushed by the caller, so it is for sure before the RET address. The images are not correct. — Preceding unsigned comment added by 87.0.76.132 (talk) 08:18, 26 November 2011 (UTC)[reply]

Hackers vs. Black Hat Hackers

At time of writing, line 19 reads:

 This is one of the oldest and more reliable methods for [[Hacker (computer security)|hackers]] to gain unauthorized access to a computer.

This, I believe, misconstrues hackers as unethical black hat hackers. It mars the name of hacker. I am changing it for the time being to black hat hacker. Added by Jon Weldon II: (talk) 04:47, 11 April 2012 (UTC)[reply]

White hat hackers also expose vulnerabilities in software by finding stack buffer overflows. I have changed it to the less culturally subjective term "attacker". Oktal (talk) 13:42, 13 July 2013 (UTC)[reply]

Picture titled " The program stack in foo() with various inputs"

Shouldn't the return address be above (in the picture) the parameter char *bar? — Preceding unsigned comment added by 192.118.35.248 (talk) 13:35, 24 October 2013 (UTC)[reply]

External links modified

Hello fellow Wikipedians,

I have just modified one external link on Stack buffer overflow. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:

Added archive http://web.archive.org/web/20070928100343/http://www.securityforest.com/downloads/educationtree/stack_overflows.pdf to http://www.securityforest.com/downloads/educationtree/stack_overflows.pdf

When you have finished reviewing my changes, please set the checked parameter below to true or failed to let others know (documentation at {{Sourcecheck}}).

This message was posted before February 2018. After February 2018, "External links modified" talk page sections are no longer generated or monitored by InternetArchiveBot. No special action is required regarding these talk page notices, other than regular verification using the archive tool instructions below. Editors have permission to delete these "External links modified" talk page sections if they want to de-clutter talk pages, but see the RfC before doing mass systematic removals. This message is updated dynamically through the template {{source check}} (last update: 5 June 2024).

If you have discovered URLs which were erroneously considered dead by the bot, you can report them with this tool.
If you found an error with any archives or the URLs themselves, you can fix them with this tool.

Cheers.—^{cyberbot II}_{Talk to my owner:Online} 03:43, 3 April 2016 (UTC)[reply]

@@ Line 1: / Line 1: @@
+{{Talk header}}
 {{WikiProject Computer Security|class=|importance=}}
 {{dyktalk|20 August|2007|entry=...that causing a '''[[stack buffer overflow]]''' is one of the oldest and most reliable methods for [[Black hat|hackers]] to gain unauthorized access to a [[computer]]?}}
+== Unnamed section ==
 The following phrase from the article is IMO suboptimal:
@@ Line 7: / Line 10: @@
 Even if "vectors" would be a verb that could be used that way (is it?), it feels very awkward to me. A more direct explanation without resorting to symbolisms would be better. Unfortunately I wasn't able to rephrase it in a more succint way :-/  <small>—Preceding [[Wikipedia:Signatures|unsigned]] comment added by [[Special:Contributions/193.247.120.15|193.247.120.15]] ([[User talk:193.247.120.15|talk]]) 22:22, 11 September 2007 (UTC)</small><!-- Template:UnsignedIP --> <!--Autosigned by SineBot-->
  Still if used in conjunction with techniques like ASLR a nonexecutable stack can be somewhat resistant to return to libc attacks and thus can greatly improve the security of an application.
 Given that ASLR protection has been shown to be effectively rendered useless in a few minutes (http://www.cse.ucsd.edu/~hovav/papers/sppgmb04.html), the above statement seems to be misleading -- [[User:Prashmohan|Prashmohan]] 10:35, 31 October 2007 (UTC)
 The example code actually uses the second command line argument to the program since arrays in C are zero based and the index 1 is used.  <small>—Preceding [[Wikipedia:Signatures|unsigned]] comment added by [[User:Gthubron|Gthubron]] ([[User talk:Gthubron|talk]] • [[Special:Contributions/Gthubron|contribs]]) 19:39, 8 April 2008 (UTC)</small><!-- Template:Unsigned --> <!--Autosigned by SineBot-->