Abstract

Security vulnerabilities often result from buffer overflows. A testing technique that instruments programs with code that keeps track of memory buffers, and checks arguments to functions to determine if they satisfy certain conditions, warns when a buffer overflow may occur. It does so when executed with ”normal ” test data as opposed to test data designed to trigger buffer overflows. A tool using this method was developed and evaluated by testing three widely used, open source software packages. This evaluation shows that the tool is useful for finding buffer overflow flaws, that it has a low false positive rate, and compares well with other techniques. 1

Citations

1363	Aspect-oriented programming - Kiczales, Lamping, et al.
972	An overview of AspectJ - Kiczales, Hilsdale, et al.
314	A first step towards automated detection of buffer overrun vulnerabilities - Wagner, Foster, et al. - 2000
269	Purify: Fast Detection of Memory Leaks and Access Errors - Hastings, Joyce - 1992
163	An Empirical Study of the Reliability of UNIX Utilities - Miller, Fredriksen, et al. - 1990
158	Statically detecting likely buffer overflow vulnerabilities - Larochelle, Evans - 2001
114	Buffer Overflows: Attacks and Defenses for the Vulnerability of the Decade - Cowan, Wagle, et al. - 2000
106	With microscope and tweezers: An analysis of the Internet virus of - Eichin, Rochlis - 1988
86	Using AspectC to improve the modularity of path-specific customization in operating system code - COADY, KICZALES, et al.
78	Fuzz revisited: A re-examination of the reliability of unix utilities and services - Miller, Koski, et al. - 1995
72	An Empirical Study of the Robustness of Windows NT Applications Using Random Testing - Forrester, Miller, et al. - 2000
67	ITS4: A static vulnerability scanner for C and C++ code - Viega, Bloch, et al. - 2000
64	Building Secure Software - Viega, McGraw - 2002
62	GENOA - a customizable, language- and front-end independent code analyzer - Devanbu - 1992
35	Cleanness checking of string manipulations in C programs via integer analysis - Dor, Rodeh, et al.
35	Mutation Analysis - Acree, Budd, et al. - 1979
32	An Automated Approach for Identifying Potential Vulnerabilities - Ghosh, O‘Connor, et al. - 1998
25	Property-Based Testing of Privileged Programs - Fink, Levitt - 1994
23	A rst step towards automated detection of bu er overrun vulnerabilities - Wagner, Foster, et al. - 2000
21	Smashing stack for fun and profit - AlephOne - 1996
16	Property based testing: A new approach to testing for assurance - Fink, Bishop - 1997
16	Vulnerability Testing of Software System Using Fault Injection - Du, Mathur - 1998
12	a C program checker. Computer Science - Lint - 1978
10	Raadt. strlcpy and strlcat — Consistent, safe, string copy and concatenation - Miller, de - 1999
8	Towards a property-based testing environment with applications to security-critical software - Fink, Ko, et al. - 1994
8	A new security testing method and its application to the secure xenix kernel - Gligor, Chandersekaran, et al. - 1987
8	and Theo de Raadt, strlcpy and strlcat—Consistent - Miller - 1999
5	An interface language between specifications and testing - Fink, Helmke, et al. - 1995
5	Experience with a Penetration Analysis Method and Tool - Gupta, Gligor - 1992
5	Statically detecting likely buer over vulnerabilities - Larochelle, Evans - 2001
4	Smashing the stack for fun and pro - One - 1996
3	Buer Over Attacks and Defenses for the Vulnerability of the Decade - Cowan, Wagle, et al. - 1999
3	Analyzing Programs for Vulnerability to Bu er Overrun Attacks - GHOSH, O'CONNOR - 1998
2	The poisoned nul byte, post to the bugtraq mailing list - Kirch - 1998
2	The poisoned NUL byte," post to the bugtraq mailing list - Kirch - 1998
1	single-byte buffer overflow vulnerability in ftpd - developers - 2000
1	An interface language between speci and testing - Fink, Helmke, et al. - 1995
1	Single-byte buer over vulnerability in ftpd - developers - 2000