缓冲区溢出 - Windows 与 Unix
我试图找出 Windows 与 Unix 中缓冲区溢出之间的安全问题。
据我了解，缓冲区溢出Windows hack无法在Unix中实现，因为每个进程都有自己的内存空间。这是否意味着Windows中的进程共享内存空间？
I'm trying to figure out the security concerns between buffer overflows in Windows vs Unix.
As I understand it, the buffer overflow Windows hack cannot be implemented in Unix because each process is given it's own memory space. Does this mean that processes in Windows share memory space?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
共享内存空间并不是大多数缓冲区溢出漏洞利用的原因。自Win 3.0（或在80286 上运行的Win 3.1）以来，Windows 就没有共享内存了，因此距离Windows 上次发布支持共享内存模型已经过去了很长一段时间，几乎20 年了。
缓冲区溢出允许攻击者更改正在被利用的进程中的内存。通过这样做，攻击者的目的是使用目标进程的权限级别执行系统操作（例如启动进程、加载动态库、更改特定用户的权限等）。
这在 Win* 平台、*nix 平台和许多其他平台上是可能的。操作系统和被利用的应用程序如何处理这种尝试才是关键所在。在应用程序方面，通常需要仔细检查缓冲区大小来避免这种情况。 ASLR（地址空间布局随机化，防止攻击者猜测她需要调用的函数的地址来造成伤害）和 DEP（数据执行预防，防止攻击者将可执行代码注入到您的数据区域）等技术，提供了通过操作系统，有很大帮助。在操作系统方面，不以 root/管理员身份运行应用程序可能是最重要的防线。
Shared memory space is not the reason for most buffer overflow exploits. Windows doesn't have shared memory since Win 3.0 (or Win 3.1 running on 80286), so it's been a long time, almost 20 years, since Windows was last shipped which supported shared memory model.
Buffer overflow allows the attacker to change memory in the process which is being exploited. By doing that the attacker is aiming to execute a system operation (for example start a process, or load a dynamic library, or change a certain user's rights, etc.) using the target processes' privilege level.
This is possible on Win* platforms, *nix platforms, and many other. How the OS and the application which is being exploited, is dealing with this attempt, is what makes the difference. On the application side, careful buffer size checking is what it usually takes to avoid this. Technologies like ASLR (address space layout randomization, which prevents the attacker from guessing the address of a function she needs to call to do harm) and DEP (data execution prevention, which prevents the attacker from injecting executable code into your data areas), provided by the OS, help tremendously. On the OS side, not running applications as root/administrator is perhaps the most important line of defense.
Windows 和 Unix 进程都具有内存隔离。缓冲区溢出攻击可能在这两种环境中发生。
Both Windows and Unix processes have memory isolation. Buffer overflow attacks can occur in both environments.
也许您应该澄清“缓冲区溢出Windows hack”的含义。缓冲区溢出不一定需要修改其他进程的代码。
示例：从 cin 读取到固定大小的字节数组可用于运行自定义代码。如果程序本身以root身份运行，那么Unix和Windows都无法采取任何措施来防止黑客攻击——内存隔离根本没有帮助。
正如 Todd 指出的那样，Windows 和 Unix 都能够进行内存隔离（与 DEP< 相比，这是非常基本的东西< /a> 或 ASLR）。
Maybe you should clarify what you mean with "buffer overflow Windows hack". Buffer-overflows do not necessarily need to modify code of other processes.
Example: Read from
cinto a fixed-sized byte array can be used to run custom code. If the program itself runs as root, neither Unix nor Windows can do anything to prevent the hack - memory isolation won't help at all.As Todd pointed out, Windows and Unix are both capable of memory isolation (which is very basic stuff compared to DEP or ASLR).