堆溢出的攻击演变与防范  

Heap Overflows:Evolution of Attacks and Defenses

作　　者：李国乐[1,2] 林志强[1,2] 茅兵[1,2] 

机构地区：[1]南京大学软件新技术国家重点实验室,南京210093 [2]南京大学计算机科学与技术系,南京210093

出　　处：《计算机工程与应用》2006年第25期102-107,119,共7页Computer Engineering and Applications

基　　金：国家863高技术研究发展计划资助项目(编号:2003AA144010)

摘　　要：以栈溢出为主的缓冲区溢出研究取得了较为丰硕的成果,与其相比,堆溢出攻击要困难许多,研究力度也少了许多。然而我们绝不能低估基于堆的溢出攻击,事实上,堆溢出已经成为攻击软件的主要方式之一。论文从基本的堆溢出开始,详细研究了堆溢出的主要攻击手段及其演变,介绍了各种常见的防御措施,并且对这些研究成果进行了分析总结。最后陈述了我们对此问题的观点。Heap overflows are more difficult to exploit than stack based overilows,and researches on it seem a Pit fewer comparing to the latter.However,we cannot underestimate the severity heap-based overflow attacks bring to computer systems,and in fact,heap overflow attacks have become one of the main methods compromising the software security.Commencing from the basic heap overflow attacks,this paper surveys all kinds of heap overflows vulnerabilities, most commonly used attacks and their evolutions.Various defense methods as well as summarizations to them are also narrated.Finally,we present our point of view on heap overflows.

关 键 词：堆溢出 缓冲区溢出 攻击 防范 计算机安全 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]