Sybex CEH Certified Ethical Hacker Version 8 Study Guide

Understanding DoS 267
Buffer Overflow
Buffer overflow is a DoS technique that takes advantage of a flaw in a program’s coding
by inputting more data than the program’s buffer, or memory space, has room for. Once
the buffer of a program is an overflow state, all further input that is written to the buffer
can have negative consequences, such as crashes, security issues, or other problems. As
with many DoS attacks, the intent is to place the program or system in an unpredictable or
unexpected state. This ties in with buffer overflow in that once a program is in an unexpected
state, the potential for a DoS condition is extremely high.
Some C functions do not perform bounds checking, which means they are
prime candidates for allowing a buffer overflow to occur. Be on the lookout
for gets(), scanf(), strcpy(), and strcat() functions. Any of these in
the code should make you suspect a buffer overflow.
The Heap and Stack
The stack and the heap are two areas of memory a program uses for storage:
Heap The heap is a dynamic storage location that does not have sequential constraints or
an organizational scheme. It is considered the larger pool of free storage for programs to
use as needed. Once the dynamic memory space is no longer needed and the program has
retrieved the needed data, the occupied space in the heap is freed up for future use.