libsafe-2.0 White Paper VERSION 3-21-01 Libsafe 2.0: Detection of Format String Vulnerability Exploits

This white paper describes a significant new feature of libsafe version 2.0: the ability to detect and handle format string vulnerability exploits. Such exploits have recently garnered attention in security advisories, discussion lists, web sites devoted to security, and even conventional media such as television and newspapers. Examples of vulnerable software include wu-ftpd (a common FTP daemon) and bind (A DNS [Domain Name System] server). This paper describes the vulnerability and the technique libsafe uses to detect and handle exploits. NOTE: This paper only describes one particular feature of libsafe version 2.0: the ability to detect and handle format string vulnerability exploits. Other features include support for code compiled without frame pointer instructions, extra debugging facilities, and bug fixes. See [1] for details of the original version of libsafe.