High-trusted-software-oriented automatic testing for integer overflow bugs

Abstract

This paper presents an automatic testing method, DAIDT (dynamic automatic integer-overflow detection and testing), for finding integer overflow fatal bugs in binary code. DAIDT can thoroughly test the binary code and automatically find unknown integer overflow bugs without necessarily knowing their symbol tables. It is formally proved in this paper that DAIDT can theoretically detect all the high-risk integer overflow bugs with no false positives and no false negatives. In additional, any bugs find by DAIDT can be replayed. To demonstrate the effectiveness of this theory, IntHunter has been implemented. It has found 4 new high risk integer overflow bugs in the latest releases of three high-trusted applications (two Microsoft WINS services in Windows 2000 and 2003 Server, Baidu Hi Instant Massager) by testing each for 24 hours. Three of these bugs allow arbitrary code execution and have received confirmed vulnerabilities numbers, CVE-2009-1923, CVE-2009-1924 from Microsoft Security Response Center and CVE-2008-6444 from Baidu. © by Institute of Software, the Chinese Academy of Sciences. All rights reserved.