Host and Application Security

Host and Application Security Lesson 9: Vulnerabilities, part 1

We now have a background… • … in how things are supposed to work

Escalation of Privilege • Now we know about authentication and access control, what is this about? • Right! • Two kinds: • Horizontal • Vertical

Vertical • Get access to something that has more privilege than you • Example: passwd bugs in Unix • In this case, this violates TOCTOU

Horizontal • User A gets to read User B’s files • An example might be predictable session IDs or user IDs in a web application • User A doesn’t escalate, but they do get more…

Race Conditions • A race condition is where the output of a system depends upon the timing of the input • This can occur at all kinds of levels – even a logic gate! • A race condition can occur when multiple threads access a global variable without locking

Misconfigurations • A web server which allows remote users to access things they should not • A sendmail server that allows relay • Smurf: missing no ip directed-broadcast

Design Flaws • A design flaw is perhaps the worst kind of vulnerability to fix • Case study: Microsoft Word Macro Viruses • Simple example: sendmail debug vulnerability

Questions?

Host and Application Security