|
Security '01 Abstract
FormatGuard: Automatic Protection From printf Format String
Vulnerabilities
Crispin Cowan, Matt Barringer, Steve Beattie, and Greg Kroah-Hartman, WireX Communications, Inc.
Abstract
In June 2000, a major new class of vulnerabilities called
"format bugs" was discovered when an vulnerability in
WU-FTP appeared that acted almost like a buffer over-flow,
but wasnÕt. Since then, dozens of format string
vulnerabilities have appeared. This paper describes the
format bug problem, and presents FormatGuard: our
proposed solution. FormatGuard is a small patch to
glibc that provides general protection against format
bugs. We show that FormatGuard is effective in protect-ing
several real programs with format vulnerabilities
against live exploits, and we show that FormatGuard
imposes minimal compatibility and performance costs.
- View the full text of this paper in
PDF and
PostScript.
The Proceedings are published as a collective work, © 2001 by the USENIX Association. All Rights Reserved. Rights
to individual papers remain with the author or the author's employer.
Permission is granted for the noncommercial reproduction of the complete
work for educational or research purposes. USENIX acknowledges all
trademarks within this paper.
- If you need the latest Adobe Acrobat Reader, you can download it from Adobe's site.
- To become a USENIX Member, please see our Membership Information.
|
Need help? Use our Contacts page.
