Testing C Programs for Buffer Overflow Vulnerabilities

DMCA

Testing C Programs for Buffer Overflow Vulnerabilities (2003)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Eric Haugh , Matt Bishop

Venue:	In Proceedings of the Network and Distributed System Security Symposium
Citations:	42 - 1 self

BibTeX

@INPROCEEDINGS{Haugh03testingc,
    author = {Eric Haugh and Matt Bishop},
    title = {Testing C Programs for Buffer Overflow Vulnerabilities},
    booktitle = {In Proceedings of the Network and Distributed System Security Symposium},
    year = {2003}
}

OpenURL

Abstract

Security vulnerabilities often result from buffer overflows. A testing technique that instruments programs with code that keeps track of memory buffers, and checks arguments to functions to determine if they satisfy certain conditions, warns when a buffer overflow may occur. It does so when executed with "normal" test data as opposed to test data designed to trigger buffer overflows. A tool using this method was developed and evaluated by testing three widely used, open source software packages. This evaluation shows that the tool is useful for finding buffer overflow flaws, that it has a low false positive rate, and compares well with other techniques.

Keyphrases

buffer overflow buffer overflow vulnerability check argument security vulnerability low false positive rate memory buffer open source software package instrument program testing technique certain condition normal test data buffer overflow flaw

DMCA