No, the additional layers of protection such as NX and ASLR only make things a little more difficult, but do not prevent arbitrary code execution. One technique

No, the additional layers of protection such as NX and ASLR only make things a little more difficult, but do not prevent arbitrary code execution. One technique that was invented to circumvent this kind of preventive measure is http://en.wikipedia.org/wiki/Return-oriented_programming http://en.wikipedia.org/wiki/Return-oriented_programming . See also http://security.stackexchange.com/questions/20497/stack-overflows-defeating-canaries-aslr-dep-nx http://security.stackexchange.com/questions/20497/stack-over... The “glass over a piece of sodium” analogy is flawed too. It makes it sound like the program has to be special and dangerous for a buffer overflow to have dramatic consequences. It doesn't. It may be an ordinary program written to fulfill an ordinary task, and contain buffer overflows that are completely exploitable.