[Secure-testing-team] A full audit of SPARC arch by our static binary analysis tool

[Jake Appelbaum]

Hi there,

I happen to work for a company that's doing some innovative development
in the area of binary static analysis. We have a shipping product that
is able to find novel exploitable vulnerabilities. The name of the
company is Logic Library Inc. The product is Logiscan
( http://www.logiclibrary.com/solutions/logiscan.php )

A short list of vulnerabilities it can find include: buffer iteration
(as seen with the blaster worm), format strings, buffer overflows
(stack/heap), off by one, SQL injection, cross site scripting and more.

We are able to verify exploitability fairly accurately by fully tracking
user-supplied data throughout the application in our static analysis. We
have some advisories and whitepapers detailing the novel vulnerabilities
we have found in commercial software.

Since we're using Knoppix as the base for our application server's OS,
we're using lots of Debian Gnu/Linux packages [1]. Knoppix is a pretty
good base for a custom Application server. I can't plug Knoppix Hacks
enough, it's very helpful (Disclaimer: I wrote a few hacks in that
book).

After reading about the lack of security resources facing the Debian
team, I thought it would be a helpful to offer the use of our product to
the Debian security team. This can be used for full audit of the SPARC
binary packages in Debian. Stable, testing, unstable, etc.

I'm sure people are a bit skeptical of a project like this and what kind
of things it can do. We're not just doing this because we use Debian but
because we want to support Free Software in general.

If you are interested, let me know and I can go into more detail. If you
have any initial questions, feel free to ask me.

[1] We comply with the GPL for all of the Free Software we're using,
including mono and the Linux kernel.

Best,
-- 
Jake Appelbaum <jacob at appelbaum.net>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 155 bytes
Desc: This is a digitally signed message part
Url : http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20050803/73d91745/attachment.pgp