On race vulnerabilities in web applications

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 5137 LNCS, Issue , 2008, Pages 126-142

  Paleari, Roberto ^a   Marrone, Davide ^a   Bruschi, Danilo ^a   Monga, Mattia ^a  

^a UNIVERSITY OF MILAN   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

CODES (STANDARDS); CODES (SYMBOLS); COMPUTER CRIME; FLOW INTERACTIONS; INFORMATION THEORY; SIGNAL ENCODING; WORLD WIDE WEB;

DYNAMIC DETECTION; INTERNATIONAL CONFERENCES; MALWARE; MULTIPLE INSTANCES; OPEN-SOURCE PROJECTS; PARALLEL EXECUTIONS; RACE CONDITION; RELATIONAL DATABASES; SEQUENTIAL CODES; VULNERABILITY ASSESSMENTS; WEB APPLICATIONS; WEB-BASED APPLICATIONS;

HAZARDS AND RACE CONDITIONS;

EID: 49949086078     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-70542-0_7     Document Type: Conference Paper

References (32)

1. NCSA Software Development Group: The Common Gateway Interface (1995)
2. Kunze, M.: Let there be light. LAMP: Freeware web publishing system with database support, c't 12, 230 (1998)
3. Cova, M., Felmetsger, V., Vigna, G.: Vulnerability Analysis of Web Applications. In: Baresi, L., Dinitto, E. (eels.) Testing and Analysis of Web Services. Springer, Heidelberg (2007)
4. Symantec Inc.: Symantec internet security threat report: Volume XII. Technical report, Symantec Inc. (September 2007)
5. Halfond, W.G., Viegas, J., Orso, A.: A Classification of SQL-Injection Attacks and Countermeasures. In: Proceedings of the IEEE International Symposium on Secure Software Engineering, Arlington, VA, USA (2006)
6. CERT: Advisory CA-2000-02: Malicious HTML Tags Embedded in Client Web Requests (2002)
7. Netzer, R.H.B., Miller, B.P.: What are Race Conditions?: Some Issues and Formalizations. ACM Letters on Programming Languages and Systems 1(1), 74-88 (1992)
8. Dean, D., Hu, A.J.: Fixing races for fun and profit: How to use access(2). In: Proceedings of the 13th conference on USENIX Security Symposium (2004)
9. Borisov, N., Johnson, R., Sastry, N., Wagner, D.: Fixing races for fun and profit: How to abuse atime. In: Proceedings of the 14th conference on USENIX Security Syposium (2005)
10. Bishop, M., Dilger, M.: Checking for race conditions in file accesses. Computing Systems 2(2), 131-152 (1996)
11. Abbott, R.P., Chin, J.S., Donnelley, J.E., Konigsford, W.L., Tokubo, S., Webb, D.A.: Security analysis and enhancements of computer operating systems.
12. phpBB Group: phpBB
13. Joomla! Core Team: Joomla!
14. Jovanovic, N.: Web Application Security. PhD thesis, Technical University of Vienna (July 2007)
15. Hind, M.: Pointer analysis: Haven't we solved this problem yet? In: 2001 ACM SIGPLAN-SIGSOFT Workshop on Program. Analysis for Software Tools and Engineering (PASTE 2001) (2001)
16. PHP Documentation Group: PHP Manual. [Online; accessed 23-November-2007].
17. MySQL AB: MySQL Reference Manual, http://dev.mysql.com/doc/refman/5.0.
18. Sterling, N.: WARLOCK - A static data race analysis tool. In: Proceedings of the Usenix Winter 1993 Technical Conference, pp. 97-106 (1993)
19. Engler, D., Ashcraft, K.: RacerX: Effective, Static Detection, of Race Conditions and Deadlocks. In: Proceedings of the Nineteenth ACM Symposium on Operating Systems Principles, pp. 237-252 (2003)
20. Flanagan, C., Freund, S.N.: Type-based race detection for Java. ACM SIGPLAN Notices 35(5), 219-232 (2000)
21. Boyapati, C., Rinard, M.: A parameterized type system for race-free java programs. In: Proceedings of the 16th ACM SIGPLAN conference on Object oriented programming, systems, languages, and applications, pp. 56-69 (2001)
22. Dinning, A., Schonberg, E.: An empirical comparison of monitoring algorithms for access anomaly detection. In: Proceedings of the Second ACM SIGPLAN Symposium on Principles & Practice of Parallel Programming, pp. 1-10 (1990)
23. Ronsse, M., Bosseliere, K.D.: RecPlay: A fully integrated practical record/replay system. ACM Transactions Computer Systems 17(2), 133-152 (1999)
24. Lamport, L.: Time, clocks, and the ordering of events in a distributed system. Communications of the ACM 21(7), 558-565 (1978)
25. Choi, J.D., Lee, K., Loginov, A., O'Callahan, R., Sarkar, V., Sridharan, M.: Efficient and precise datarace detection for multithreaded object-oriented programs. ACM SIGPLAN Notices 37(5), 258-269 (2002)
26. Cheng, G.I., Feng, M., Leiserson, C.E., Randall, K.H., Stark, A.F.: Detecting data races in Cilk programs that use locks. In: Proceedings of the 10th Annual ACM Symposium on Parallel Algorithms and Architectures, pp. 298-309 (1998)
27. Savage, S., Burrows, M., Nelson, G., Sobaivarro, P., Anderson, T.E.: Eraser: A dynamic data race detector for multithreaded programs. ACM Transactions on Computer Systems 15(4), 391-411 (1997)
28. Yu, Y., Rocleheffer, T., Chen, W.: RaceTrack: Efficient detection of data race conditions via adaptive tracking. Technical report, Microsoft Research (April 2005)
29. Pozniansky, E., Schuster, A.: Efficient on-the-fly data race detection in multithreaded C++ programs. ACM SIGPLAN Notices 38(10), 179-190 (2003)
30. Tsyrklevich, E., Yee, B.: Dynamic detection and prevention of race conditions in file accesses. In: Proceedings of the 12th USENIX Security Symposium (August 2003)
31. Chamillard, A.T., Clarke, L.A., Avrunin, G.S.: An empirical comparison of static concurrency analysis techniques (July 23, 1996)
32. Visser, W., Havelund, K., Brat, G., Park, S.J.: Model checking programs. In: Proceedings of the 15th IEEE International Conference on Automated Software Engineering (September 2000)