Elena Haritonova

Aug 10 2008

Detection of vulnerabilities in programs with the help of code analyzers

Aug 10 2008

Author: Elena Haritonova

Introduction
Classification of security vulnerabilities
Review of existing analyzers
Conclusion
References

At present there are a lot of tools intended for automating search of program vulnerabilities. This article describes some of them.

Introduction

Static code analysis is software analysis which deals with the source code of programs and is implemented without real execution of the program being examined.

Software often contains various vulnerabilities because of errors in program code. Errors made while developing programs cause program failure and consequently the program cannot work normally: data alteration and contamination often occur as well as program halt or even system halt. Most of the vulnerabilities relate to incorrect processing of input data or not rather strict check of these data.

To detect vulnerabilities different tools are used, for example, static analyzers of source program code, which are reviewed in this article.

Classification of security vulnerabilities

When a requirement of correct work of a program at all possible input data is violated, the so called security vulnerabilities may occur. Security vulnerabilities may result in that one program may be used to overcome security limitations of the whole system.

Classification of security vulnerabilities depending on program errors:

Buffer overflow. This vulnerability occurs because of absence of control over excess of array size in memory during program execution. When too a large data burst overflows a buffer of a limited size, the content of outside memory cells is rewritten and program halt occurs. Depending on the place of the buffer's location in the process's memory, stack buffer overflow, heap buffer overflow and bss buffer overflow can be distinguished.
Tainted input vulnerability. Tainted input vulnerability can occur when data input by the user without sufficient control are passed to an interpreter of some outer language (usually it is Unix shell or SQL). In this case the user can define the input data in that way that the launched interpreter executes some other command than that meant by the authors of the vulnerable program.
Format string vulnerability. This type of security vulnerabilities is a subclass of tainted input vulnerability. It occurs because of insufficient control over parameters while using functions of format input-output printf, fprintf, scanf etc of the standard C library. These functions receive a symbol string as one of the parameters defining input or output format of following arguments of the function. If the user can define the format type himself, this vulnerability may occur as the result of an unlucky use of string formatting functions.
Vulnerabilities resulting from race condition errors. Problems relating to multitasking cause situations called "race conditions": a program not intended to be executed in a multitask environment can suppose that, for example, files used by it while working cannot be changed by another program. As the result, an intruder who substitutes the content of these working files can make the program perform certain actions.

Of course, there exist other types of security vulnerabilities.

Review of existing analyzers

To detect security vulnerabilities in programs the following tools are used:

Dynamic debuggers - tools which allow you to perform debugging of a program during its execution.
Static analyzers (static debuggers) - tools using information collected during static analysis of a program.

Static analyzers point out those sections in a program where an error may occur. These suspicious sections of the code may both contain an error and be useless at all.

Some of the existing static analyzers are reviewed in this article. Let's discuss each of them in detail.

1. BOON

BOON tool, being based on deep semantic analysis, automates the process of scanning source C texts to detect vulnerable sections which can cause buffer overflow. It detects possible defects supposing that some values are part of an implicit type with a concrete buffer's size.

2. CQual

CQual is a tool to detect errors in C programs. The program introduces additional type qualifiers defined by the user to C language. The programmer comments his program with corresponding qualifiers and cqual searches errors. Incorrect annotations indicate possible errors. Cqual can be used to detect possible format string vulnerability.

3. MOPS

MOPS (MOdel checking Programs for Security) is a tool to search security vulnerabilities in C programs. It is intended for dynamic patch to make a C program correspond to a static model. MOPS uses a software auditing model which is meant to find out if the program observes a set of rules defined to create safe programs.

4. ITS4, RATS, PScan, Flawfinder

To detect buffer overflow errors and format string errors the following static analyzers are used:

ITS4. A simple tool which scans source C/C++ code to detect potential security vulnerabilities. It records calls of potentially unsafe functions, for example, such as strcpy/memcpy and performs surface semantic analysis trying to estimate if this code is unsafe and also provides advice of improving it.
RATS. RATS utility (Rough Auditing Tool for Security) processes C/C++ code and Perl, PHP and Python scripts. RATS scans source code detecting potentially unsafe function calls. The aim of this tool is not the final detection of errors but making valid conclusions for a specialist to perform manual check of the code. RATS combines different kinds of security check from semantic check in ITS4 to deep semantic analysis to find defects received from MOPS which can cause buffer overflow.
PScan. It scans source C texts to detect potentially incorrect functions similar to printf and format string vulnerabilities.
Flawfinder. Like RATS this is a static scanner of source C/C++ program texts. It searches functions which are very often used incorrectly, assigns risk coefficients to them (relying on such information as parameters passed) and composes a list of potential vulnerabilities arranging them according to the risk level.

All these tools are similar and use only lexical analysis and simple syntax analysis. That's why the results provided by these programs may contain even 100% of false messages.

5. Bunch

Bunch is a tool of analysis and visualization of C programs building a graph of dependencies which help the auditor to examine the modular structure of the program.

6. UNO

UNO is a simple analyzer of source code. It was developed to detect such errors as unassigned variables, zero pointers and excess of array limits. UNO allows you to perform simple analysis of execution thread and data threads, both intra- and interprocedure analysis, specify the user properties. But this tool cannot be used for analysis of real applications, doesn't support many standard libraries and doesn't allow you to analyze however serious programs at the present stage of development.

7. FlexeLint (PC-Lint)

FlexeLint (PC-Lint) - this analyzer is intended for analyzing source code to detect different type errors. The program performs semantic analysis of source code, analysis of data and execution threads.

When the work is done, messages of several types are shown:

A zero pointer is possible;
Problems of memory allocation (for example free() after malloc() is absent);
Problem of execution thread (for example, the code is inaccessible);
Buffer overflow or arithmetic overflow are possible;
Warning messages about bad and potentially unsafe code style.

8. Viva64

Viva64 tool which helps a specialist to detect in the source code of C/C++ programs potentially unsafe sections relating to porting from 32-bit systems on 64-bit ones. Viva64 integrates into Microsoft Visual Studio 2005/2008 what provides convenient work with this tool. The analyzer helps to write correct and optimized code for 64-bit systems.

9. Parasoft C++test

Parasoft C++test is a specialized tool for Windows allowing you to automate analysis of C++ code quality. C++test package analyzes the project and generates the code intended for checking items of the project. C++test package performs very important work of analyzing C++ classes. When the project is loaded it is necessary to set testing methods. The software analyzes each argument of a method and returns types of corresponding values. Argument values are assigned by default in case of data of simple types; you can define testing data for types and classes defined by the user. You can redefine C++test arguments used by default and assign values received as the result of the test. We should mention also that C++test can test incomplete code. The software generates stub-code for any method and function which doesn't exist yet. It supports imitation of external devices and input data defined by the user. The both functions allow you to perform retesting. When testing parameters are defined for all the methods, C++test package is ready to launch the executed code. The package generates test-code calling Visual C++ compiler to create it. You can implement tests on method, class, file and project levels.

10. Coverity

Coverity tools are used to detect and correct security and quality defects in applications of critical purpose. Coverity company's technology removes barriers in writing and introducing complex software by automating the process of searching and correcting critical program errors and security vulnerabilities during development. Coverity company's tool can process tens of millions of code strings with a minimum positive error providing full trace coverage.

11. KlocWork K7

Klocwork company's products are intended for automatic static code analysis, detection and prevention of software defects and security problems. Tools of this company are used to detect basic reasons of software quality and security vulnerabilities, to control and prevent these defects during the whole development process.

12. Frama-C

Frama-C is an open, integrated set of tools for analyzing C source code. The set includes ACSL (ANSI/ISO C Specification Language) - a special language allowing you to describe specifications of C functions in detail, for example, define the range of acceptable input values of a function and the range of normal output values.

This toolkit helps to:

Perform formal code test;
Search potential execution errors;
Perform code auditing or reviewing;
Perform reverse-engineering of the code to understand the structure better;
Generate formal documentation.

13. CodeSurfer

CodeSurfer is a tool for program analysis, the main aim of which is not to search security vulnerability errors. Its main advantages are:

Pointer analysis;
Different analyses of the data thread (use and definition of variables, data dependency, building of the call graph);
Scripting language.

CodeSurfer can be used to detect errors in source code, to make source code clearer, and to reengineer programs. Within the framework of CodeSurfer a prototype of a tool to detect security vulnerabilities has been developed, but the developed tool is used only by the developers of the organization.

14. FxCop

FXCop provides means of automatic testing of .NET-integrations to find out if they meet Microsoft .NET Framework Design Guidelines rules. The compiled code is tested with the help of reflection mechanism, MSIL parsing and analysis of the call graph. As the result FxCop can detect more than 200 defects (or errors) in the following spheres:

The library's architecture;
Localization;
Naming rules;
Performance;
Security.

FxCop supports the possibility of creating your own rules with the help of special SDK. FxCop can work both in the graphical interface and in the command line.

15. JavaChecker

JavaChecker is a static analyzer of Java programs based on TermWare technology.

This tool allows you to detect such code defects as:

Careless handling of exceptions (empty catch-blocks, generating of exceptions of general type etc);
Hiding of names (for example, when the name of a class member coincides with the name of a formal method parameter);
Style violation (you can define a programming style using a set of regular expressions);
Violation of standard use contracts (for example, when equals method is redefined instead of hashCode);
Synchronization violation (for example, when access to a synchronized variable is situated outside the synchronized block).

The set of tests can be controlled by using control comments.

JavaChecker can be called from ANT script.

16. Simian

Simian is an analyzer of similarity which searches repeating syntax in several files simultaneously. The program understands syntax of different programming languages including C#, T-SQL, JavaScript and Visual Basic®, and can also search repeating sections in text files. A lot of setting possibilities allow you to set precise rules of searching doubling code. For example, threshold parameter estimates how many repeating code strings should be considered to be a doublet.

Simian is a small tool developed for effective search of code repetitions. It lacks graphical interface but it can be launched in the command line or called programmatically. The results are printed in text mode and can be represented in one of the embedded formats (for example, XML). Although its poor interface and limited possibilities of result print demand some learning, it helps to keep integrity and efficiency of the product. Simian can be used to search repeating code both in small and large projects.

Repeating code makes a project less supportable and updatable. You may use Simian for quick search of doubling code sections in many files simultaneously. As Simian can be launched in the command line it can be included into the building process to receive warning messages and stop the process if some code sections are repeated.

Conclusion

So, in this article we've discussed source code static analyzers which serve as auxiliary tools for a programmer. All the tools are different and help to detect various types of security vulnerabilities in programs. We could conclude that static analyzers must be precise and sensitive. But unfortunately, static debugging means cannot guarantee 100% safety.