格式化字符串漏洞研究.pdfVIP

1,2, 2, † 1,‡ 1 100087 2 WEB100087 shellcode Survey of Format String Vulnerability Xu-Tao Du1,2 Chun-Xiao Xing2 1 Department of Computer Science, Tsinghua University, Beijing 100080 2 Research Center of WEB and Software Engineeing, Tsinghua University, Beijing 100080 Abstract Format string vulnerability is a vital threat to computer systems and networks. By exploiting the format string vulnerability, attackers can break into computer systems in the internet. They can get various information about the computer systems and can even get full control of them. Since the principle and methods of exploiting format string vulnerability and that of exploiting traditional buffer overflow vulnerability are different, tools for preventing buffer overflow attacks will usually fail in front of format string attacks. For the High-Confidential Software, its very important to avoid and prevent from the damage of format string vulnerability. This paper introduce the format string vulnerability. After point out its origin and potential damage, we show the method to exploit this vulnerability through several concrete examples. Then we introduced some protecting tools for this vulnerability. Keywords Format String Vulnerability; Shellcode; Attack; Protecting Tools dxt05@ † xingcx@ ‡ dcszlz@ 1 Format String Vulnerability 1999Tymm Twillman[1] 2000tf8BugTraq wu-ftpd [2]