| Abstract |
|
A format string attack exploits the fact that variadic func- tions determine the exact number of input arguments based on the format string argument, and compromises the vic- tim application's address space by accessing data areas be- yond the original input argument list the caller prepares. This paper describes the design, implementation and evalu- ation of a Win32 binary transformation tool called Lisbon, which transparently inserts into Win32 binaries additional checks that protect them from format string vulnerabilities. Lisbon casts the format string attack prevention problem as an input argument list bound checking problem. To reduce the run-time checking overhead, Lisbon exploits the debug register hardware, which is available in most mainstream CPUs including Intel's X86 architecture, to detect if a callee accesses data outside the input argument list. Moreover, Lisbon is able to detect format string attacks without inter- preting their format strings and is thus potentially appli- cable to similar attacks against other functions that access input arguments in the same way as printf(). The run- time throughput penalty of the first Lisbon prototype is un- der 2% for a set of test network applications that are known to be vulnerable to format string attacks.
|
 Additional Information
|
Citation:
Wei Li, Tzi-cker Chiueh,
"Automated Format String Attack Prevention for Win32/X86 Binaries,"
acsac,
pp. 398-409,
Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007),
2007
|
