Language bugs infest downstream software, fuzzer finds
And you worked so hard to make it secure
Developers working in secure development guidelines can still be bitten by upstream bugs in the languages they use.
That's the conclusion of research presented last week at Black Hat Europe by IOActive's Fernando Arnaboldi.
As Arnaboldi wrote in his Black Hat Europe paper [PDF]: “software developers may unknowingly include code in an application that can be used in a way that the designer did not foresee. Some of these behaviors pose a security risk to applications that were securely developed according to guidelines.”
To run his test, Arnaboldi created a differential fuzzer, XDiFF, which compares behaviour of different inputs, versions, implementations and operating system implementations of the same piece of software.
|Category||Number of Functions Tested|
The kinds of bugs revealed in the tests included undocumented features in Python, which provided OS-level command execution; information disclosure in NodeJS via error messages, a JRuby function that loads remote code for execution (RCE), and an RCE in PHP using the names of constants. ®