Heap overflow exploit and understanding

[Nytro]

Heap overflow exploit and understanding

Khalil Ezhani

Senator.of.Pirates @ gmail.com

http://www.facebook.com/SenatorofPirates

Not all buffers are allocated on the stack. Often an application doesn't know how big to make certain buffers until

it is running. The heap is used by applications to dynamically allocate buffers of varying sizes. These buffers are

susceptible to overflows if user-supplied data isn't checked, leading to a compromise through an attacker

overwriting other values on the heap.

Where the details of stack overflow exploitation rely on the specifics of hardware architecture, heap overflows are

reliant on the way certain operating systems and libraries manage heap memory. Here I restrict the discussion of

heap overflows to a specific environment: a Linux system running on an Intel x86 platform, using the default

GNU libc heap implementation (based on Doug Lea's dlmalloc). While this situation is specific, the techniques I

discuss apply to other systems, including Solaris and Windows.

Heap overflows can result in compromises of both sensitive data (overwriting filenames and other variables on

the heap) and logical program flow (through heap control structure and function pointer modification). I discuss

the threat of compromising logical program flow here, along with a conceptual explanation and diagrams.

Download:

http://www.exploit-db.com/download_pdf/18133