ITS4: A Static Vulnerability Scanner for C and C++ Code

We describe ITS4, a tool for statically scanning security-critical C source code for vulnerabilities. Compared to other approaches, our scanning technique stakes out a new middle ground between accuracy and efficiency. This method is efficient enough to offer real-time feedback to developers during coding while producing few false negatives. Unlike other techniques, our method is also simple enough to scan C++ code despite the complexities inherent in the language. Using ITS4 we found new remotelyexploitable vulnerabilities in a widely distributed software package as well as in a major piece of e-commerce software. The ITS4 source distribution is available at http: //www.rstcorp.com/its4.

• Type: Conference
• Year: 2000
• Where: ACSAC
• Authors: John Viega, J. T. Bloch, Y. Kohno, Gary McGraw
• Keywords: ACSAC 2000, Code For Vulnerabilities, False Negatives, Security Privacy, Technique Stakes