A buffer overflow occurs when a program or process tries to store more data in a buffer than it was intended to hold. Since buffers can only hold a specific amount of data, when that capacity has been reached, the data has to flow somewhere else, typically into another buffer, which can corrupt data that is already contained in that buffer. Although it may occur accidentally through programming error, buffer overflow is an increasingly common type of security attack on data integrity.
In buffer overflow attacks, the extra data may contain codes designed to trigger specific actions, sending new instructions to the attacked computer that could, for example, damage the user's files, change data, or disclose confidential information.
The “Stack” and the “Heap” are the two primary types of buffer overflow situations. One type involves overwriting and changing security sensitive variables or control flags stored in memory adjacent to the unchecked buffer. The most common type of stack overflow involves the overwriting of function pointers that can be used to change program flow or gain elevated privileges within the operating system environment. The more complex heap overflow involves dynamic memory allocations.
Getting access to memory allows offenders to control the system and learn confidential data which can be used for more severe attacks causing very serious consequences. The weakness is introduced during Architecture and Design, Implementation, Operation stages.