Buffers overflow Vs Escape-Character Attacks

On the surface, this attack seems very similar to the buffer overflow attack discussed earlier; indeed, they both the exploit the same flaw of unconstrained input. The difference is that with buffer overflow attacks, we attempt to send the applications a string that is too long for the memory allocated for it. With some careful appending of low-level commands to the end of this string, the operating system can be deceived into executing these commands rather than, or in addition to, applications instructions. To exploit a buffer overflow for the first time usually requires a fairly savvy attacker, because appended commands must be in machine language. Unfortunately, though attack string sometimes become widely distributed and then the so call “script kiddie” class of attacker can exploit these weakness, too. 

Escape character attacks use special characters embedded in strings of usually normal length to force the application to execute commands. Since many of these escape sequences are standard, a minimally skilled hacker can potentially craft a string which executed authorized commands. This means that the knowledge necessary to exploit an escape character vulnerability for the first time is minimal, which makes these types of bugs as or more dangerous than buffer overflows.