Question

EXplain why strcat and strcpy can be used to perform buffer overflow attack?

Answer 1

A buffer is location for storage of data. When more data flows by program the data overflows or gets overridden.

In butter overflow attack some data holds instructions for activities intended by attacker or hacker.

The function strcpy(buffer, str) copies the contents from str to buffer[].

The string pointed by str has more than 12 chars, while the size of buffer[] is only 12.

The function strcpy() does not check whether the boundary of buffer[] has reached. It

only stops when seeing the end-of-string character ’\0’.

Therefore, contents in the memory above buffer[] will be overwritten by the characters at

the end of str. This is the limitation of strcpy().

Meanwhile strcpy() can be used to to extent so that it will minimize the attack.

Functions that restrict the number of bytes are often recommended to mitigate against buffer overflow vulnerabilities.

strncpy() instead of strcpy()

fgets() instead of gets()

snprintf() instead of sprintf()

Strings that exceed the specified limits are truncated.

Truncation results in a loss of data, and in somecases, to software vulnerabilities.

So only till some extent strcat and strcpy can be used to perform buffer overflow attack.