Precisely Detecting Buffer Overflow Vulnerabilities

WANG Lei; LI Ji; LI Bo-yang

您当前的位置：

首页 >

文章列表页 >

Precisely Detecting Buffer Overflow Vulnerabilities

更新时间：2025-07-16

- Precisely Detecting Buffer Overflow Vulnerabilities
- Acta Electronica Sinica Vol. 36, Issue 11, Pages: 2200-2204(2008)
- 作者机构：
  
  北京航空航天大学计算机学院,北京,100083
- 作者简介：
- 基金信息：
- DOI：
  CLC： TP314
- Published：2008
- 稿件说明：
移动端阅览
WANG Lei, LI Ji, LI Bo-yang. Precisely Detecting Buffer Overflow Vulnerabilities[J]. Acta Electronica Sinica, 2008, 36(11): 2200-2204.
DOI：

WANG Lei, LI Ji, LI Bo-yang. Precisely Detecting Buffer Overflow Vulnerabilities[J]. Acta Electronica Sinica, 2008, 36(11): 2200-2204. DOI：

摘要

缓冲区溢出漏洞是影响系统安全性的严重问题之一

本文提出了一种利用模型检测技术对代码中潜在的缓冲区溢出漏洞进行精确检测的方法.该方法通过静态分析

先将对缓冲区漏洞的检测转化为对程序某个位置可达性的判定.然后

利用模型检测技术对可达性进行验证.基于GCC和Blast

我们使用这一方法构造了一个精确检测缓冲区溢出漏洞的原型系统.最后

使用该原型系统对wu-ftpd

minicom和CoreHTTP等三个实际应用程序进行了检测

结果不仅检测出了已知的漏洞

而且发现了一些新漏洞.

Abstract

Buffer overflow(BO)vulnerability is one of the most crucial threats to the security of software system

and a method using model checking was proposed to precisely detect potential BO vulnerabilities in source code.This method converts detecting BO vulnerabilities to verifying the reachability of certain position in programs by static analysis.Then model checking was used to do the verification job.Based on GCC and Blast

a prototype system to precisely detect BO vulnerabilities was developed for this method.At last

wu-ftpd

minicom and CoreHTTP was checked by the prototype system

which not only detected those known BO vulnerabilities but also some unknown BO vulnerabilities.

关键词

Keywords

references

Views

1774

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Conditional Context-Aware Detection for Android Malicious Virtualization Apps

Research on Interaction Modeling and Mismatch Checking of Time-Aware Web Services

Exact Acceleration of Real-Time Model Checking Based on Parking Cycle

Specification and Verification of Web Service Composition Based on XYZ/ADL

A Method of Variable Range Analysis Based on Abstract Interpretation and Its Applications

Related Author

XIONG Yan

ZHANG Wei-nan

HUANG Wen-chao

MENG Zhao-yi

Sheng

ZHANG Guang-quan

RONG Mei

WANG Sheng

Related Institution

School of Computer Science and Technology， Anhui University

School of Computer Science and Technology， University of Science and Technology of China

Shenzhen Tourism CollegeJinan UniversityShenzhenGuangdong 518053China

State Key Laboratory of Computer ScienceChinese Academy of ScienceBeijing 100190China

School of Computer Science and TechnologySoochow UniversitySuzhouJiangsu 215006China

⁰