Security flaw in Microsoft .NET compiler

Cigital, a software risk management (SRM) solution provider, today announced the discovery of a design-level flaw in a security feature included in Microsoft’s Visual C++.NET and Visual C++ version 7 compiler.

The defect, which leaves executable code built by the compiler vulnerable to a buffer overflow attack, was uncovered in Cigital Labs during testing of Cigital’s soon-to-be-released security assessment product.

The Microsoft compiler was specifically enhanced with a feature meant to protect potentially vulnerable source code automatically from certain forms of buffer overflow attack. Because the protection mechanism itself is susceptible to a buffer overflow attack, developers who make use of the feature may come away with a false sense of security and unintentionally discount critical implementation problems. Malicious hackers can then exploit the software once it is fielded, leaving unsuspecting users completely exposed.

Cigital CTO and author of Building Secure Software, Gary McGraw says, ‘There is no ‘just add water’ solution for software and application security, especially at the deign level. The fact that even security features such as Microsoft’s broken buffer overflow protection mechanism fall prey to security problems demonstrates the challenge we face. Cigital Labs’ discovery shows why relying on a runtime compiler feature to protect against certain types of attacks is not sufficient. All developers and architects should put in place a rigorous software security regimen that includes source code review. Computer security hangs in the balance.’

‘In January 2002, Bill Gates outlined Microsoft’s Trustworthy Computing initiative. This flaw’s existence serves to emphasize how much hard work it takes to build secure and reliable software. There is much more to software security than simply demonstrating the right attitude,’ states Jeffery Payne, president and CEO of Cigital.

On the web