Testing Static Analysis Tools using Exploitable Buffer Overflows from Open Source Code Zitser, Lippmann & Leek Presented by: José Troche

Motivation Real attacks in server software Malicious code and DoS Why Static Analysis tools? Dynamic approach is expensive & incomplete Safe languages make runtime checks Perform an unbiased evaluation

Tools Evaluated ToolAnalysis StrategyCom ARCHER Bottom-up inter-procedural, flow- sensitive, symbolic triggers BOON Inter-procedural, flow-insensitive, only strings PolySpace Inter-procedural, flow-sensitive, abstract interpretation Y SPLINT Intra-procedural, lightweight analysis UNO Inter-procedural, flow-sensitive, model checking

Test Cases BIND (4) Most popular DNS server WU-FTPD (3) Popular FTP daemon Sendmail (7) Dominant mail transfer agent Total vulnerabilities: 14

Initial experience (145K lines) Splint issued parse errors ARCHER quit with a Div/0 error PolySpace run 4 days and quit

New Testing Approach Create lower scale models BAD vs. OK version Retrospective analysis

Results SystemP(detection)P(false+)P(~f|d) PolySpace Splint Boon Archer Uno00-

Discussion Detection Rate: 3 of 5 < 5% High rate of false alarms (1 in 12 & 46) Results only on marked lines Insensitive to corrections (<40%) None was able to analyze sendmail

Conclusion Results are promising: Errors were detected Need of improvement because of: False positives Poor discrimination