309
Strategy = Environment Hardening
Use a CPU and operating system that offers Data Execution Protection (using hardware NX
or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX
[REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a
memory address that is part of the code segment. For more information on these techniques see
D3-PSEP (Process Segment Execution Prevention) from D3FEND [REF-1336].
Effectiveness = Defense in Depth
This is not a complete solution, since buffer overflows could be used to overwrite nearby
variables to modify the software's state in dangerous ways. In addition, it cannot be used in
cases in which self-modifying code is required. Finally, an attack could still cause a denial of
service, since the typical response is to exit the application.
Phase: Build and Compilation
Phase: Operation
Most mitigating technologies at the compiler or OS level to date address only a subset of buffer
overflow problems and rarely provide complete protection against even that subset. It is good
practice to implement strategies to increase the workload of an attacker, such as leaving the
attacker to guess an unknown value that changes every program execution.
Phase: Implementation
Replace unbounded copy functions with analogous functions that support length arguments,
such as strcpy with strncpy. Create these if they are not available.
Effectiveness = Moderate
This approach is still susceptible to calculation errors, including issues such as off-by-one errors
(CWE-193) and incorrectly calculating buffer lengths (CWE-131).
Phase: Architecture and Design
Strategy = Enforcement by Conversion
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a
mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs,
and reject all other inputs.
Phase: Architecture and Design
Phase: Operation
Strategy = Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks
[REF-76]. If possible, create isolated accounts with limited privileges that are only used for a
single task. That way, a successful attack will not immediately give the attacker access to the
rest of the software or its environment. For example, database applications rarely need to run as
the database administrator, especially in day-to-day operations.
Phase: Architecture and Design
Phase: Operation
Strategy = Sandbox or Jail
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between
the process and the operating system. This may effectively restrict which files can be accessed
in a particular directory or which commands can be executed by the software. OS-level examples
include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide
some protection. For example, java.io.FilePermission in the Java SecurityManager allows the
software to specify restrictions on file operations. This may not be a feasible solution, and it
CWE Version 4.14
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')