Buffer Overflow Resources

From Robert Ricci's guest lecture in Sneha Kasera's CS6490 (Network Security) class, March, 2007.

My lecture outline
Much of the information in the lecture came from Chapter 6 of The Hacker's Handbook, by Susan Young and Dave Aitel.
Some material also came from Security in Computing by Shari and Charles Pfleeger
Simple diagram of memory layout and overflow: Part 1 (normal operation), Part 2 (overflowed buffer)
Program call stack diagram (from Wikipedia)
CWE vulnerability trends - used to discuss the relative importance of buffer overflows and other types of vulnerabilities.
Description of cross-site scripting attacks (XSS) on Wikipedia
Description of PHP remote file inclusion attacks on Wikipedia
The Firefox IDN (International Domain Name) vulnerability we discussed: BugZilla page, CERT Vulnerability Note, Initial report, publicly-released exploit (warning: live link!)
Gera's Insecure Programming page, inspiration for some of the homework problems.
A page with a large collection of articles about buffer overflows