slides - PDOS - MIT

More documents

Recommendations

Info

Prevalence of embedded interpretersand related vulnerabilitiesSoftware Interpreter Known vulnerabilitiesBPFINET_DIAGAMLRarVMLLVMCVE-2010-4158 CVE-2012-3729CVE-2010-3880 CVE-2011-2213CVE-2010-4347 CVE-2011-1021CVE-2007-3725CVE-2011-3627Bitcoin bitcoin CVE-2010-5137Python Pickle CVE-2011-2520 CVE-2012-4406FreeTypeTrueType / Type 1CharstringCVE-2010-2520 CVE-2011-0226
Our contributions• Studies of 10 widely-used embeddedinterpreters in real world• Studies of known vulnerabilities• Security guidelines• Research opportunities
Page 1 and 2: Security Bugs inEmbedded Interprete
Page 3 and 4: Embedded interpretersHost systemByt
Page 5 and 6: Embedded interpretersHost systemByt
Page 7 and 8: Prevalence of embedded interpreters
Page 13: Prevalence of embedded interpreters
Page 17 and 18: A packet filtering example• Monit
Page 19 and 20: A packet filtering example• Monit
Page 21 and 22: A packet filtering example• Straw
Page 23 and 24: A packet filtering example• Straw
Page 25 and 26: Solution: Berkeley Packet Filter (B
Page 39 and 40: Security of embedded interpreters
Page 45 and 46: INET DIAG infinite loop vulnerabili
Page 51: INET DIAG infinite loop vulnerabili
Page 56 and 57: ClamAV signed division vulnerabilit
Page 64 and 65:
FreeType arbitrary code executionJa
Page 66 and 67:
FreeType arbitrary code executionpu
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Security guidelines
Page 76 and 77:
Security guidelines• A better sol
Page 78 and 79:
Pitfall 1: complex feature sets•
Page 80 and 81:
Pitfall 1: complex feature sets•
Page 82 and 83:
Pitfall 2: resource consumption•
Page 84 and 85:
Pitfall 3: calls to the host system
Page 86 and 87:
Research Opportunities
Page 88 and 89:
Research Opportunities• Testing e
Page 90 and 91:
Research Opportunities• Testing e
Page 92 and 93:
References• BPF: S. McCanne and V
Page 94:
Q & ASecurity Bugs inEmbedded Inter
show all

slides - PDOS - MIT

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?