1. Host and Application Security Lesson 9: Vulnerabilities, part 1

2. We now have a background…  … in how things are supposed to work

3. Escalation of Privilege  Now we know about authentication and access control, what is this about?  Right!  Two kinds: Horizontal Vertical

4.  Get access to something that has more privilege than you  Example: passwd bugs in Unix  In this case, this violates TOCTOU

5. Horizontal  User A gets to read User B’s files  An example might be predictable session IDs or user IDs in a web application  User A doesn’t escalate, but they do get more…

6. Race Conditions  A race condition is where the output of a system depends upon the timing of the input  This can occur at all kinds of levels – even a logic gate!  A race condition can occur when multiple threads access a global variable without locking

7. Misconfigurations  A web server which allows remote users to access things they should not  A sendmail server that allows relay  Smurf: missing no ip directed-broadcast

8. Design Flaws  A design flaw is perhaps the worst kind of vulnerability to fix  Case study: Microsoft Word Macro Viruses  Simple example: sendmail debug vulnerability

9. Questions?