views:

285

answers:

3

I'm trying to figure out the security concerns between buffer overflows in Windows vs Unix.

As I understand it, the buffer overflow Windows hack cannot be implemented in Unix because each process is given it's own memory space. Does this mean that processes in Windows share memory space?

+1  A: 

Both Windows and Unix processes have memory isolation. Buffer overflow attacks can occur in both environments.

Todd Stout
Ah, I didn't realize that. Thanks!
Goose Bumper
+2  A: 

Shared memory space is not the reason for most buffer overflow exploits. Windows doesn't have shared memory since Win 3.0 (or Win 3.1 running on 80286), so it's been a long time, almost 20 years, since Windows was last shipped which supported shared memory model.

Buffer overflow allows the attacker to change memory in the process which is being exploited. By doing that the attacker is aiming to execute a system operation (for example start a process, or load a dynamic library, or change a certain user's rights, etc.) using the target processes' privilege level.

This is possible on Win* platforms, *nix platforms, and many other. How the OS and the application which is being exploited, is dealing with this attempt, is what makes the difference. On the application side, careful buffer size checking is what it usually takes to avoid this. Technologies like ASLR (address space layout randomization, which prevents the attacker from guessing the address of a function she needs to call to do harm) and DEP (data execution prevention, which prevents the attacker from injecting executable code into your data areas), provided by the OS, help tremendously. On the OS side, not running applications as root/administrator is perhaps the most important line of defense.

Rom
+1  A: 

Maybe you should clarify what you mean with "buffer overflow Windows hack". Buffer-overflows do not necessarily need to modify code of other processes.

Example: Read from cin to a fixed-sized byte array can be used to run custom code. If the program itself runs as root, neither Unix nor Windows can do anything to prevent the hack - memory isolation won't help at all.

As Todd pointed out, Windows and Unix are both capable of memory isolation (which is very basic stuff compared to DEP or ASLR).

Marcel J.
To be fair the OS simply cannot do process isolation and DEP unless the underlying machine supports it. IBM-PCs couldn't do either and DEP has been possible only recently. Full ASLR takes its toll in terms of performance which is why many OSes do it lazily. IIRC Macs were lagging far behind in ASLR until Snow Leopard.
jbcreix