Buffer Overflow

[dave_mustaine]

Softsphere also has a program to protect against buffer overflow that is called DefencePlus and this is ther description for it:

DefencePlus:
DefencePlus (previously known as Anti-Cracker Shield) is a powerful proactive multi-level defense for an old-styled processors without NX/XD-bit on-board against hackers, viruses and Internet worms which may try to attack your computer with buffer overflow exploits. It provides a level of defense that is not covered by anti-virus or firewall software.
DefencePlus protects your system against buffer overflow “exploits” which Hackers often use to ■■■■■ computers on the Internet. These exploits exist owing to the vulnerabilities in many different components of your operating system, as well as those of application software such as network games, Internet-browsers, and e-mail programs etc). In any of these exploitable cases, neither anti-virus nor firewalls would be able to protect you. Only DefencePlus, a multi-level proactive security system, is able to cope with all known and unknown versions of these “exploits”. DefencePlus provides the highest security possible and enables computers to work at their intended optimum level.

So, my question is; do I only need buffer overflow protection if I have a old-styled processor without NX/XD-bit on-board?

Could someone explain this to me?

[Endymion]

Buffer oveflow Protection can also be implemented in hardware leveraging on the NX bit feature of new processors.

In Windows OSes BO protection is called DEP.

@Tyler Durden (Comodo Developer) post:1

1. Software DEP is nothing but SEH chain validator (means it’s not a DEP but some way to prevent one rare type of shellcode’s injection)
2. Hardware DEP is very incompatible thing, that’s why:
   a) DEP mode by default is OptIn = all system services are protected, user apps aren’t protected
   b) DEP is VERY incompatible thing so we 've got one more “layer” over DEP-mode - windows disables DEP for app which is know to be incompatible with DEP (this includes many checks, like exe-packers check and so on)
3. DEP-protection is vulnerable to ret2libc kind of attack (so you’re not protected at all)

Comodo BO protection was designed to improve compatibility and thus protect all apps against ret2libc and common BO attacks also in cases where DEP result incompatible with some applications.

There is a Buffer Overflow Testing Application available as well.

[Citizen_K]

DEP doesn’t catch all of the BO problems/attacks.

BO protection is a security gem as approx 65% of all vulnerabilities found in software are of this kind of error. Not many products have this kind of protection. I know Sophos AV has it and another program which name I can’t recall.