Insecure Compiler Optimization - Revision history

Imifos at 12:40, 22 January 2016

2016-01-22T12:40:54Z

2015-12-02T12:44:34Z

2009-02-26T10:59:02Z

‎Description

2009-02-24T14:11:13Z

‎Example: "Dead store removal"

2009-02-21T01:24:25Z

2009-02-18T02:32:15Z

2008-11-02T14:30:33Z

2008-09-26T14:15:48Z

2008-09-26T14:15:13Z

2006-07-21T18:03:46Z

Added contents provided by Fortify.

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
-Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 [[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
@@ Line 105: / Line 105: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Environmental Vulnerability]]
-[[Category:OWASP C/C++ Project]]
+[[Category:C/C++]]
 [[Category:Implementation]]
 [[Category:Code Snippet]]
 [[category:Compiler]]
 [[Category:Vulnerability]]

@@ Line 105: / Line 105: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Environmental Vulnerability]]
-[[Category:C]]
+[[Category:OWASP C/C++ Project]]
 [[Category:Implementation]]
 [[Category:Code Snippet]]
 [[category:Compiler]]
 [[Category:Vulnerability]]

@@ Line 14: / Line 14: @@
 * Secret data is stored in memory.
 * The secret data is scrubbed from memory by overwriting its contents.
 * The source code is compiled using an optimizing compiler, which identifies and removes the function that overwrites the contents as a dead store because the memory is not used subsequently.
 ==Risk Factors==

@@ Line 27: / Line 27: @@
 Memory overwriting code is removed by optimizing compiler, which causes sensitive information left in the memory after its usage.
-The following code reads a password from the user, uses the password to connect to a back-end mainframe and then attempts to scrub the password from memory using memset().
+The following code reads a password from the user, uses the password to connect to a back-end mainframe, and then attempts to scrub the password from memory using memset().
 <pre>
@@ Line 46: / Line 46: @@
 Attackers typically exploit this type of vulnerability by using a core dump or runtime mechanism to access the memory used by a particular application and recover the secret information. Once an attacker has access to the secret information, it is relatively straightforward to further exploit the system and possibly compromise other resources with which the application interacts.
 ==Related [[Attacks]]==

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:Fortify}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
+[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 ==Description==

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+__TOC__
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
-[[ASDR Table of Contents]]
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
@@ Line 117: / Line 118: @@
 [[Category:Code Snippet]]
 [[category:Compiler]]

@@ Line 25: / Line 25: @@
 ==Risk Factors==
-* Talk about the [[OWASP Risk Rating Methodology|factors]] that make this vulnerability likely or unlikely to actually happen
+TBD
 ==Examples==
@@ Line 67: / Line 64: @@
 * [[Vulnerability 1]]
 * [[Vulnerabiltiy 2]]
@@ Line 75: / Line 70: @@
 * [[Control 1]]
 * [[Control 2]]

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 ==Description==
-Security problems caused by compiler optimization.
+Compiler optimization errors occur when:
 ==Examples ==
-* "Dead store removal"
+'''Example: "Dead store removal"'''
 Memory overwriting code is removed by optimizing compiler, which causes sensitive information left in the memory after its usage.
 ==Related Threats==
@@ Line 19: / Line 48: @@
 ==Related Countermeasures==
-==Related Technologies==
+==References==
-[[:Technology:Compiler]]
 ==Categories==
+[[Category:Environmental Vulnerability]]
-{{Template:Stub}}
+[[Category:C]]