Six weeks ago, I asked Bugtraq for responses on the question of whether buffer overflows dominate the area of security vulnerabilities as part of a paper I was writing. Numerous people asked me to post results when I'm done. On the narrow question: approximately 2/3 of respondants thought that buffer overflows do indeed dominate the problem of security vulnerabilities. The remaining 1/3 thought that mis-configuration was the dominant problem. I respect both views, but think that "misconfiguration" is not really a software problem, it's an operational problem. Thus, one could say that buffer overflows are the leading cause of software vulnerabilities, and misconfiguration is the leading operational problem. Which problem dominates overall vulnerability is unclear. On the broader question: the paper is complete. It will appear at the DARPA Information Survivability Expo ( http://schafercorp-ballston.com/discex/ ) and will also appear as an invited talk at SANS 2000 ( http://www.sans.org/newlook/events/sans2000.htm ). This paper categorizes the various kinds of buffer overflow attacks, the various kinds of defensive measure that can be employed, and shows which defenses are effective against which attacks. The paper itself is available for download here: http://immunix.org/StackGuard/discex00.pdf Crispin ----- Crispin Cowan, CTO, WireX Communications, Inc. http://wirex.com Free Hardened Linux Distribution: http://immunix.org
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:13:48 PDT