logo
logo

Language bugs infest downstream software, fuzzer finds

avatar
Johnny Huff
img

Developers working in secure development guidelines can still be bitten by upstream bugs in the languages they use.

That's the conclusion of research presented last week at Black Hat Europe by IOActive's Fernando Arnaboldi.

As Arnaboldi wrote in his Black Hat Europe paper [PDF]: “software developers may unknowingly include code in an application that can be used in a way that the designer did not foresee.

Some of these behaviors pose a security risk to applications that were securely developed according to guidelines.”

Arnaboldi found bugs in the major programming languages JavaScript, Perl, PHP, Python and Ruby, and in all cases, he said the vulnerabilities could expose software written using those languages.

To run his test, Arnaboldi created a differential fuzzer, XDiFF, which compares behaviour of different inputs, versions, implementations and operating system implementations of the same piece of software.

collect
0
avatar
Johnny Huff
guide
Zupyak is a free content platform for publishing and discovering stories, software and startups.