LibsafeXP: A practical and transparent tool for run-time buffer overflow preventions

Proceedings of the 2006 IEEE Workshop on Information Assurance

Volumn 2006, Issue , 2006, Pages 332-339

  Lin, Zhiqiang ^a   Mao, Bing ^a   Xie, Li ^a  

^a NANJING UNIVERSITY   (China)

Author keywords

[No Author keywords available]

Indexed keywords

BUFFER STORAGE; COMPUTER SOFTWARE; DIGITAL LIBRARIES; INFORMATION RETRIEVAL; KNOWLEDGE ACQUISITION; STORAGE ALLOCATION (COMPUTER);

BUFFER OVERFLOW ATTACKS; LIBSAFEXP; SOFTWARE PROTECTION; WRAPPER FUNCTIONS;

SECURITY OF DATA;

EID: 33845919861     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (20)

1. NIST, National Vunerability Database. http://nvd.nist.gov, May 2006.
2. A. Baratloo, N. Singh, and T. Tsai. Transparent run-time defense against stack smashing attacks (Libsafe -Libverify). In Proc. of 2000 USENIX Annual Technical Conference, San Diego, California, USA, Jun. 2000.
3. TIS (Tool Interface Standards). Executable and Linkable Format Specification, UNIX System Laboratories.
4. T. Cormen, C. Stein, R. Rivest and C. Leiserson. Introduction to Algorithms. MIT Press, second edition. 2002.
5. P. Phantasmagoria. Glibc Malloc Exploitation Techniques. http://packetstormsecurity.org/papers/attack/MallocMaleficarum.txt, 2005.
6. Z. Xiao. An Automated Approach to Software Reliability and Security. Invited Talk, Department of Computer Science, University of California at Berkeley, 2003.
7. C. Cowan, C. Pu, D. Maier, J. Walpole, P. Bakke, S. Beattie, A. Grier, P. Wagle, and Q. Zhang. StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. In Proc. of the 7th USENIX Security Symposium, Jan. 1998.
8. H. Ozdoganoglu, T. Vijaykumar, C. E. Brodley, A. Jalote. SmashGuard: A Hardware Solution to Prevent Security Attacks on the Function Return Address. Technical Report, Purdue University, Dec. 2002.
9. R. Lee, D. Karig, J. McGregor and Z. Shi. Enlisting Hardware Architecture to Thwart Malicious Code Injection. Security in Pervasive Computing, Boppard, Germany, Mar. 2003.
10. O. Ruwase and M. S. Lam. A Practical Dynamic Buffer Overflow Detector. In Proc. of the 11th Annual Network and Distributed System Security Symposium, Feb. 2004.
11. D. Larochelle and D. Evans. Statically detecting likely buffer overflow vulnerabilities. In Proc. of the 2001 USENIX Security Symposium, Washington DC, USA, Aug. 2001.
12. J. Newsome and D. Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proc. of the 12th Annual Network and Distributed System Security Symposium. 2005.
13. R. Jones and P. Kelly. Backwards-compatible bounds checking for arrays and pointers in C programs. In Proc. of the International Workshop on Automatic Debugging, May 1997.
14. K. Avijit, P. Gupta, D. Gupta. TIED, LibsafePlus: Tools for Runtime Buffer Overflow Protection. In Proc. of the 13th USENIX Security Symposium, Aug. 2004.
15. V. Kiriansky, D. Bruening, and S. Amarasinghe. Secure execution via program shepherding. In Proc. of the 11th USENIX Security Symposium, Aug. 2002.
16. J.Wilander and M.Kamkar. A Comparison of Publicly Available Tools for Dynamic Buffer Overflow Prevention. In Proc. of the 10th Network and Distributed System Security Symposium, Feb. 2003.
17. H. Feng, J. Giffin, Y. Huang, S. Jha, W. Lee, and B. Miller. Formalizing Sensitivity in Static Analysis for Intrusion Detection. In Proc. of IEEE Symposium on Security and Privacy, May 2004.
18. E.G. Barrantes, D.H. Ackley, S. Forrest, T. Palmer, D. Stefanovic and D. Zoviet. Randomized instruction set emulation to disrupt binary code injection attacks. InProceedings of the 10th ACM Conference on Computer and Communication Security, Oct. 2003.
19. G.S. Kc, A.D. Keromytis, V. Prevelakis. Countering Code-Injection Attacks With Instruction-Set Randomization. In Proceedings of the 10th ACM Conference on Computer and Communication Security, Oct. 2003.
20. S. Bhatkar, R. Sekar and D. DuVarney. Efficient Techniques for Comprehensive Protection from Memory Error Exploits. In Proc. of the 14th USENIX Security Symposium, Aug. 2005.