Software Security

This chapter focuses on how security failures in software arise and how they can be avoided or counteracted. The main classes of unintentional security failure in software—Buffer overflow, buffer overread, incomplete mediation and time-of-check-to-time-of-use flaws—are described, and ways of detecting the software faults which lead to the failures are discussed. The various types of malware, which deliberately cause security failures, and their ways of operating, are presented and the principles of operation of antivirus systems for dealing with malware are described. Some types of software can be exposed to code injection, where unchecked user input causes undesirable code to be executed, with unexpected and possibly dangerous effects. The chapter presents three examples of this phenomenon: In systems which use SQL-based databases, in systems which use LDAP databases, and in systems which allow users to include (malicious) scripts in their input. The chapter concludes by reviewing a number of vulnerabilities in HTTP and in web servers, and a discussion of the challenges presented by the use of software which generates dynamic web content.