An Analysis of Some Software Vulnerabilities
Ivan Krsul, Eugene Howard Spafford, Mahesh Tripunitara · 1998
Many engineering fields have recognized the need to analyze past mistakes and failures in the hope of learning from them. In computer science this realization has resulted in the development of software testing techniques that attempt to detect known problems from software systems and in improved compilers and development tools. However, there exists a series of software failures where detailed analysis is rarely published, mainly for fear that the information could be used against active systems. These software failures, commonly referred to as computer vulnerabilities, have special properties that set them apart from traditional software failures. Detailed analysis of the factors that contribute to the existence of these vulnerabilities is mostly limited to cryptic articles posted to hacker newsgroups or web sites. There are a few notable exceptions, and this report attempts to add to these with a detailed analysis of four common computer vulnerabilities. The analysis of each vulnera...