4 ms·

I've always wondered - what are the most (in)famous buffer overflow exploits? Heartbleed is one of the most popular ones I guess.

• bandrami 10y ago
  Heartbleed isn't a buffer overflow in the classic sense (you're not writing more to a buffer than it expects to receive), it's just that you could set read buffer sizes that you shouldn't have been able to in a sane world. In that sense it wasn't even a "bug" (the software was doing exactly what the programmer intended), just a badly-specified protocol to begin with.
• stevekemp 10y ago
  The Morris worm is literally the grand-daddy when it comes to buffer-overflows: https://en.wikipedia.org/wiki/Morris_worm https://en.wikipedia.org/wiki/Morris_worm After that you could see something like SQL Slammer as having a significant impact: https://en.wikipedia.org/wiki/SQL_Slammer https://en.wikipedia.org/wiki/SQL_Slammer But from a technical perspective most of them are much of a muchness - I'm more interested in the first time "things" were written up, such as "Smashing The Stack For Fun And Profit": http://insecure.org/stf/smashstack.html http://insecure.org/stf/smashstack.html Or the first time that Format string attacks were documented - a whole class of vulnerabilities sprang up overnight (my memory is that wu-ftp was the original target there). http://www.drdobbs.com/when-format-strings-attack/184405774 http://www.drdobbs.com/when-format-strings-attack/184405774
  • pjmlp 10y ago
    > The Morris worm is literally the grand-daddy when it comes to buffer-overflows. In 1988!
• deleted 10y ago
  [deleted]