Statically scanning Java code: Finding security vulnerabilities

IEEE Software

Volumn 17, Issue 5, 2000, Pages 68-74

  Viega, John ^a   McGraw, Gary ^d   Mutdosch, Tom ^b   Felten, Edward W ^c  

^a Cigital   (United States)

^b Rochester Institute of Technology   (United States)

^c Princeton University   (United States)

^d NONE

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; JAVA PROGRAMMING LANGUAGE; PROGRAM DEBUGGING;

SOURCE CODE SCANNING;

SECURITY OF DATA;

EID: 0034270432     PISSN: 07407459     EISSN: None     Source Type: Journal    
DOI: 10.1109/52.877869     Document Type: Article

References (11)

1. G. McGraw, "Software Assurance for Security," Computer, Vol. 32, No. 4, Apr. 1999, pp. 103-105.
2. C. Cowan et al., "Stackgard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attack," Proc. Seventh Usenix Security Symp., Usenix Assoc., San Diego, Calif., 1998.
3. R. Pethia, "CERT/CC 10th Anniversary Retrospective and Intruder Outlook for the Next 10 Years," Information Survivability Workshop, 1998.
4. T. Gilb and D. Graham, Software Inspections, Addison-Wesley, Reading, Mass., 1993.
5. G. McGraw and E. Felten, Securing Java: Getting Down to Business with Mobile Code, John Wiley & Sons, New York, 1999.
6. J. Viega et al., "ITS4: A Static Vulnerability Scanner for C and C++ Code," to be published in Proc. Ann. Computer Security Applications Conf. 2000, Dec. 2000.
7. D.S. Wallach and E.W. Felten, "Understanding Java Stack Inspection," Proc. 1998 IEEE Symp. Security and Privacy, IEEE Computer Soc. Press, Los Alamitos, 1998.
8. D. Dean, E.W. Felten, and D.S. Wallach, "Java Security: From HotJava to Netscape and Beyond," Proc. 1996 IEEE Symp. Security and Privacy, IEEE Computer Soc. Press, Los Alamitos, Calif., 1996, pp. 190-200.
9. D. Dean et al., "Java Security: Web Browsers and Beyond," Internet Besieged: Countering Cyberspace Scofflaws, D.E. Denning and P.J. Denning, eds., ACM Press, New York, 1997.
10. G. McGraw and E. Felten, "Twelve Rules for Developing More Secure Java," Java World, Dec. 1998, www. javaworld.com/javaworld/jw-12-1998/jw-12-securityrules. html (current Aug. 2000).
11. E. Gamma et al., Design Patterns: Elements of Reusable Object Oriented Software, Addison-Wesley, Reading, Mass., 1995.