Re: Buffer Overruns

["Steven M. Bellovin" <smb () research att com>]

In message <E11zSbB-0000mB-00 () polaris shore net>, Vin McLellan writes:
>        It there something in the emergence of a popular Internet, or some
> other timely aspect in the industry's evolution, that has brought to light
> the vulnerabilities associated with buffer overruns in recent years? 
>
>        Maybe some shift in program design or programming engineering
> practice?  What left so many of these vulnerabilities unexposed and their
> risks unappreciated for so many years?
>
>        Sometimes even in <ahem> widely distributed source code.

I think it's a combination of closing of some other holes, the growth of the 
net in general (and hence more attackers and more targets), and the emergence 
of canned toolkits for building such attacks.  You no longer need to be an 
assember language wizard to do it; you just take the snippets, and adjust a 
few constants until it works.

I don't think that changes in practice have contributed much; if anything, the 
emergence of C++ (with its built-in String class) should have helped.  But too 
many programmers write C using a C++ compiler, and C is a *lousy* language for 
avoiding such attacks.

                --Steve Bellovin