A First Step towards Automated Detection of Buffer Overrun Vulnerabilities (2000)
Cached
Download Links
- [www.cs.umd.edu]
- [www.cs.umd.edu]
- [www.isoc.org]
- [www.eecs.umich.edu]
- [www.bennetyee.org]
- [www.bennetyee.org]
- [www.bennetyee.org]
- [www.bennetyee.org]
- [www.simovits.com]
- [www.cs.cornell.edu]
- [www.cs.berkeley.edu]
- [HTTP.CS.Berkeley.EDU]
- [www.cs.umd.edu]
- [now.cs.berkeley.edu]
- [www.cs.berkeley.edu]
- [http.cs.berkeley.edu]
- [www.eecs.berkeley.edu]
- [www.gnucash.org]
- DBLP
Other Repositories/Bibliography
| Venue: | In Network and Distributed System Security Symposium |
| Citations: | 339 - 10 self |
BibTeX
@INPROCEEDINGS{Wagner00afirst,
author = {David Wagner and Jeffrey S. Foster and Eric A. Brewer and Alexander Aiken},
title = {A First Step towards Automated Detection of Buffer Overrun Vulnerabilities},
booktitle = {In Network and Distributed System Security Symposium},
year = {2000},
pages = {3--17}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
We describe a new technique for finding potential buffer overrun vulnerabilities in security-critical C code. The key to success is to use static analysis: we formulate detection of buffer overruns as an integer range analysis problem. One major advantage of static analysis is that security bugs can be eliminated before code is deployed. We have implemented our design and used our prototype to find new remotely-exploitable vulnerabilities in a large, widely deployed software package. An earlier hand audit missed these bugs. 1.
