Microsoft response to alleged VC++ security
Security | at | by Mike
To be clear, the security check feature introduced in the Microsoft Visual C++ .NET compiler is NOT vulnerable. The allegation that applications compiled with Visual C++'s /GS switch some how expose themselves to more attacks is unfounded and patently false. The Cigital press release itself says it, "This security feature is meant to protect potentially vulnerable source code automatically from _some_ forms of buffer overflow attacks." The expectation is right there, some forms of buffer overflow attacks can evade the compiler injected security checks. This understanding makes the following statement in the Cigital press release questionable:
"The protection afforded by the new feature allows developers to continue to use vulnerable string functions such as strcpy() as usual and still be "protected" against some forms of stack smashing."