Lit. Buffer overruns 1692

A few good points and updated stats in article on writing your own shell code exploit:

"Buffer overflows have been around for decades and are simply the result of insecure programming practices. There are some methods, like non-executable stacks (see the sidebar), that try to mitigate these types of vulnerabilities, but there really is no subsbreastute for security conscience programming practices.

Using functions like strncpy() and strlcpy() instead of strcpy() copies strings up to a maximum length, giving you more control. There is nothing inherently wrong with using strcpy() in general, but there is if you can't be certain the destination is at least as large as the source. Just try to think about what would happen if someone were to input an extra large piece of data, because if it's a public program, someone out there eventually will.

According to the National Insbreastute of Standards and Technology, in the past 4 years, 871 buffer overflow vulnerabilities were exploited, comprising about 20 percent of all exploits. ** ^^ The world of computers has developed astronomically since the 1960s, yet buffer overflow vulnerabilities have persisted. It's 2005 now -- perhaps it's about time for general programming practices to catch up."

-- Thanks. Take care, Brian Inglis Calgary, Alberta, Canada

fake address use address above to reply