One Must Not Have---19 Fatal Security Vulnerabilities in Software

Author: Michael Howard, David LeBlanc, John Viega
Publisher:
Publish Date: 2006-11-01
Features: We usually expect computers to perform tasks as instructed, and in real life, we accomplish this through software. Currently, both computers and their software have become extremely complex, and from clicking the mouse to seeing the desired results, multiple layers of software may be involved. To fully utilize the capabilities of the computer platform, we often rely on the correctness of these software layers. For these software layers, each layer may encounter problems, and the results of software execution may not be what the author intended or, at least, not what the computer operator needs. These vulnerabilities introduce a certain level of uncertainty into our systems, leading to significant security vulnerabilities. Some of these vulnerabilities are relatively simple, such as software or system crashes (which can be used for denial-of-service attacks) or buffer overflows (which allow attackers to replace application code to execute arbitrary commands). This book follows the principles of being concise, easy to read, and practical, covering currently popular programming languages and runtime platforms, and addressing 19 common fatal vulnerabilities related to software security. The book combines theory and practice, providing detailed descriptions, underlying principles, detection methods, and mitigation measures for each vulnerability. Additionally, for each vulnerability, the authors have selected real-world examples from systems to illustrate them, making them more intuitive and memorable for readers. Moreover, in the mitigation measures, the authors provide specific code solutions in multiple languages, further enhancing the book's practicality.