A newly released report makes a series of unfounded allegations about the security of Visual C++ .NET. The report is incorrect—the claimed security flaw simply does not exist, and Visual C++ .NET works correctly. However, the report has spawned a number of news articles and we have received many questions from customers about it. In response, Microsoft would like to provide additional information about the report and the feature it discusses below.
The claims involve the operation of a feature in the Visual C++ .NET compiler (which ships as part of Visual Studio .NET). This feature, known as Buffer Security Checking, provides an additional layer of security in the event that a programmer unknowingly develops a program containing a common coding error known as a buffer overrun. Buffer overruns are a serious security threat, and have been implicated in many serious security vulnerabilities. Buffer Security Checking prevents some types of buffer overruns from being exploited, even if the programmer does happen to make such an error.
|