程序漏洞:原因、利用与缓解——以C和C++语言为例  

Cause, Exploitation and Mitigation of Program Vulnerability——C and C++ language as an example

作　　者：陈小全 薛锐[1] CHEN Xiaoquan XUE Rui(State Key Laboratory Of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China)

机构地区：[1]中国科学院信息工程研究所信息安全国家重点实验室,北京中国100093 [2]中国科学院大学网络空间安全学院,北京中国100049

出　　处：《信息安全学报》2017年第4期41-56,共16页Journal of Cyber Security

基　　金：中国科学院战略性先导科技专项(批准号:XDA06010701)项目;中国科学院信息工程研究所密码基金资助;国家自然科学基金(No.61472414;No.61772514)

摘　　要：程序中存在的漏洞是针对程序的各种攻击事件的根源,攻击者可以利用这些漏洞改变程序的行为或完全控制程序。本文以C语言和C++语言为例循序渐进地阐明了程序中漏洞产生的根本原因,并对利用这些漏洞实施的攻击进行了深入地分析和探讨,同时也指出了当前主要的漏洞检测和漏洞阻止技术的优势和不足。最后,我们提出了对程序进行持续的和全面的内存布局多样性的未来研究方向。The vulnerability in the program is the source of the attacks against the program. These vulnerabilities allow the attackers to alter the behavior of the program or completely control the program. Firstly, this paper clearly explains the fundamental reason of the vulnerability in the program. Secondly, the attacks that exploit these vulnerabilities have been analyzed and discussed thoroughly. Thirdly, this paper also points out the advantages and weaknesses of the current vul- nerability detection and defense technology. Finally, the future research direction the Continuous and Comprehensive Memory Layout Diversity is proposed.

关 键 词：程序漏洞 利用 缓解 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]