Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Bug Google Open Source

Google Found Over 1,000 Bugs In 47 Open Source Projects (helpnetsecurity.com) 55

Orome1 writes: In the last five months, Google's OSS-Fuzz program has unearthed over 1,000 bugs in 47 open source software projects... So far, OSS-Fuzz has found a total of 264 potential security vulnerabilities: 7 in Wireshark, 33 in LibreOffice, 8 in SQLite 3, 17 in FFmpeg -- and the list goes on...
Google launched the program in December and wants more open source projects to participate, so they're offering cash rewards for including "fuzz" targets for testing in their software. "Eligible projects will receive $1,000 for initial integration, and up to $20,000 for ideal integration" -- or twice that amount, if the proceeds are donated to a charity.
This discussion has been archived. No new comments can be posted.

Google Found Over 1,000 Bugs In 47 Open Source Projects

Comments Filter:
  • Profit! (Score:5, Funny)

    by xxxJonBoyxxx ( 565205 ) on Saturday May 13, 2017 @10:39AM (#54410723)
    >> or twice that amount ($40K), if the proceeds are donated to a charity.

    1) Create some horribly insecure OSS software
    2) Set up charity, make self "director", limit payouts to cause to under 5%, set director fees to around 90%
    3) Integrate Google fuzz, report self and payout to, er, "charity"
    4) PROFIT!
  • Great news! (Score:3, Insightful)

    by therealspacebug ( 4922543 ) on Saturday May 13, 2017 @10:40AM (#54410725)
    This is what open source is about. Together making software better and more secure!
    • by Dutch Gun ( 899105 ) on Saturday May 13, 2017 @11:45AM (#54410917)

      If you haven't done this for your projects, fuzz testing is an awesome stability and security test for any sort of input parser.

      I maintain a small open source project (that no one but me uses, but hey, it's there if people want), and I found several bugs in the parser with my fuzz tests. I just wrote a *very* simple test myself using basic mutation techniques (randomly altering samples of valid input data), and it was still pretty effective.

      I'm looking forward to hearing about further positive results from this project.

    • by Anonymous Coward on Saturday May 13, 2017 @12:38PM (#54411109)

      YOU ARE MISREADING. 1000+ bugs WERE FOUND, that's BECAUSE the projects are OPEN SOURCE and PEOPLE CARED TO LOOK. FTFY.

  • by Anonymous Coward on Saturday May 13, 2017 @10:42AM (#54410727)

    Thank you, this shows again the advantage of open source free software. Now all communities can start fixing the bugs. There is no security by obscurity, or it's just a false misperception, possible like with proprietary software.

    • by Anonymous Coward on Saturday May 13, 2017 @11:06AM (#54410793)

      Isn't it interesting how it takes a multi-billion dollar closed-source development company to clean up the security messes left by open source software?

      • by xxxJonBoyxxx ( 565205 ) on Saturday May 13, 2017 @11:08AM (#54410803)
        This popped out of the Chrome project, if I'm reading this right. From:
        https://github.com/google/oss-fuzz/

        >> Currently OSS-Fuzz supports C and C++ code (other languages supported by LLVM may work too).
        >> We (did) fuzzing of Chrome components...now want to share the...service with the open source community.
      • by haruchai ( 17472 ) on Saturday May 13, 2017 @11:26AM (#54410849)

        Isn't it interesting how it takes a multi-billion dollar closed-source development company to clean up the security messes left by open source software?

        Isn't it interesting how it takes an unpaid outfit to expose the hacks of a multi-billion dollar closed state-sponsored terrorist agency taking advantage of the security messes of multi-billlion dollar closed source development companies?

      • by nyet ( 19118 ) on Saturday May 13, 2017 @11:33AM (#54410865) Homepage

        Ever heard of valgrind?
        scan-build?
        libasan?

        • by Anonymous Coward on Saturday May 13, 2017 @01:05PM (#54411191)

          That would be yes on valgrind and no on the 2 others.
          I love valgrind and because of that I am now going to look up what the other 2 are.
          Do you know other tools that I might enjoy using ?

          (PS: I'm another anonymous coward then the one you replied to and have no opinion one way or the other about what he said)

      • by Anonymous Coward on Saturday May 13, 2017 @11:39AM (#54410893)

        There are plenty of commercial companies with buggy software or software which has declined in quality since it was first created. The advantage of open source is that people who use the software can all look at the code and submit modifications or fork if there's something they really need enough to put the investment in. Commercial software, unless it is open source, does not have that advantage. This can make a huge difference in the case of security concerns as well.

        In fact, there is no more engaged community than that which also helps edit and check the code. If you have a community doing that, you know they are fully invested. At that point, the only way they are going to fork is if the interests truly diverge.

      • by chipschap ( 1444407 ) on Saturday May 13, 2017 @12:25PM (#54411067)

        Isn't it interesting how it takes a multi-billion dollar closed-source development company to clean up the security messes left by open source software?

        As opposed to closed-source security messes that NEVER get cleaned up?

      • by phantomfive ( 622387 ) on Saturday May 13, 2017 @12:29PM (#54411075) Journal
        If only they'd fix their own bugs.

        Could be worse: they could be Apple.
  • by Anonymous Coward on Saturday May 13, 2017 @11:03AM (#54410783)

    I'm surprised they found so few in libreoffice compared to sqlite. Sqlite has the most extensive unit tests I've ever seen in my life. and LibreOffice is just so huge relative to it. I guess that goes to saying they're doing a pretty good job.

    • Re:surprised (Score:5, Informative)

      by DRichardHipp ( 995880 ) on Saturday May 13, 2017 @11:38AM (#54410889)

      The SQLite developers were also surprised by how many bugs OSS-Fuzz (and American Fuzzy Lop [coredump.cx]) have found in SQLite.

      The best explanation I have is that OSS-Fuzz and AFL are exploring extreme corner-cases of the code where human-generated tests would never think to go. Fuzzing is great for finding bugs that involve totally unreasonable inputs that never happen in actual practice and which can only appear as part of a deliberate attack. Fuzzing has not found any bugs that would impact the day-to-day use of SQLite.

      In other words, fuzzing finds an entirely different class of bugs from what the mountains of other test cases [sqlite.org] for SQLite are designed to find. This is a good thing. We encourage testing diversity.

      Here is a list of issues found in SQLite by OSS-Fuzz (and now fixed): https://www.sqlite.org/src/sea... [sqlite.org]

      There are a few cases of NULL pointer dereferences or other crashes that come about while unwinding the stack following an Out-Of-Memory error. Those kinds of errors are real, and we are grateful to OSS-Fuzz for finding them, even if they are seldom seen in the wild. Other issues were assertion faults that probably would not have resulting in a crash if assert() has been disabled (which is the case for all default builds of SQLite). And then there are things like https://www.sqlite.org/src/tim... [sqlite.org] which is not really a bug at all - OSS-Fuzz was submitting a funky recursive VIEW query that after unwinding all the nested views resulted in a very larger prepared statement, which took too long to process and so OSS-Fuzz timed out. SQLite was getting the correct answer, it was just taking too long. Since the submitted SQL was of no practical use, we "fixed" that problem by limiting the size of prepared statements to be about 100 times larger than any real SQL statement needs to be, rather than the default limit of about a 10 million times larger.

      • by Anonymous Coward on Saturday May 13, 2017 @01:03PM (#54411183)

        See subject: You built SQLite starting in the Navy but what's in my subject's fact - & why I posted https://it.slashdot.org/comments.pl?sid=10606043&cid=54410839/ [slashdot.org] as to WHY I elected NOT to use SQLite (& yes, I thought about it - makes dedup extremely fast via I would wager a Select * distinct type query, assuming your product uses std. SQL that is - I don't use it, I don't know)...

        * Above ALL else - Hey, I'm not knocking you man (honestly) as I respect your work but from what I've read? WHY DID YOU ELECT TO USE C (buffer overflow exploitation galore via null-terminated strings) as its base constructing language?? Object Pascal HAS string length "built-in" to each string (no possible of that same issue)

        It's integrated (iirc, SQLite compiles INTO the app statically? Not a lib?? Correct me here/set me straight - big on that here - Why I like Delphi's Object-Pascal's VCL is THAT very reason - less "moving parts" hanging around etc.)

        APK

        P.S.=> My guess? It's the language you KNEW how to use best & went w/ it - right? Correct me when & where I am "off" here - & always a pleasure to speak to someone who might be considered a "luminary" of sorts (you'd be one of them imo - John Carmack's been another as well as Cliff Stoll whom I am spoken w/ here)... apk

        • by Anonymous Coward on Sunday May 14, 2017 @04:54AM (#54413211)

          To me you sound like a drunk troll that actually, purposely or not, gives actual object pascal users a bad reputation. None of your accusations/questions or arguments make sense, and same goes for your writing style.

          Hipp made a great piece of software that over time is more widely adapted than anyone ever imagined. If you don't like it, don't use it. But if his design is 'so wrong' as you try to claim, question yourself why this piece of lightweight portable code has become so massively popular.

          Now, please get back to your basement and dont' come trolling out for the next 10 years please.

          • by Anonymous Coward on Sunday May 14, 2017 @08:24AM (#54413651)

            1st, you fool yourself - thought's too complex for "your kind". Widely used full of bugs is GOOD? I know not.

            * Knew this was coming using others' libs or code - hence why I avoided using SQLite (or other 3rd party code in most shareware/freeware work I've done over time).

            APK

            P.S.=> However: At least Hipp produced something. He's a "doer" (I won't take that from him he earned it) - but you & "your kind" - mere "ne'er-do-well" talkers? YOU'RE ALL HOT-AIR BLOWHARD WINDBAG DO-NOTHING TALK & nothing more... apk

          • by Anonymous Coward on Sunday May 14, 2017 @08:27AM (#54413665)

            I'm going to continue using the Host File Engine. Your software is well written, functional. The Host File Engine performs exactly as promised by mmell

            his hosts program is actually pretty good by xenotransplant

            his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg

            I've never tried to belittle (APK's) work, I've flat out said it's good by BronsCon

            take a look at the APK hosts file engine by SuperKendall

            APK is kinda right. I've tried his hosts file generating software. It works by bmo

            I like your host file system by Karmashock

            I find your hosts file admirable by vel-ex-tech

            * My code's liked + recommended & hosted by Malwarebytes' hpHosts!

            APK

            P.S.=> Per my subject & your crap you tried feeding me "ne'er-do-well"? You've done BETTER?? Prove it... apk

      • by Anonymous Coward on Saturday May 13, 2017 @03:06PM (#54411573)

        I also think it is a testament to how thorough some fuzz targets are compared to others. SQLite obviously took the charge seriously. Theirs is DEEP and can do all sorts of edge cases and tests huge chunks of the code; most others are much more limited in what they can uncover because they focus on certain functions or are limited in the input the provided. If anything, SQLite's high numbers show how seriously they take testing and how good performance is to keep timeouts limited. Similarly, the lack of high numbers in huge projects, like LibreOffice, show the opposite.

    • by Anonymous Coward on Saturday May 13, 2017 @06:47PM (#54412151)

      I'm surprised they found so few in libreoffice compared to sqlite.

      Part of that might be the comparative number of test entry points in the libreoffice vs. sqlite tests.

      OSS-Fuzz doesn't automatically determine the entry functions over which it fuzzes. Instead, a person has to manually curate and enable fuzzing for each function you want fuzz tested. The more functions you hook up to the fuzzer, the more chances you have to find bugs.

      The other thing to keep in mind is that the OSS-Fuzz fuzzer only really works well with fast, self-contained functions where you have a relatively limited amount of input data. It doesn't work well if you have functions which work on state, or on functions which are stateless but have massive amounts of context data. When OSS-Fuzz works, it's feeding your function-fuzzing framework arbitrary bytestreams. If you can't take an *arbitrary* bytestream and parse it into a reasonable set of inputs for the function, the fuzzer doesn't work to well.

      I don't know what the comparison of number of functions and code coverage for libreoffice vs. sqlite, but I'm betting that sqlite having excellent unit test coverage is the reason why more bugs are found on it. Setting things up for good unit test coverage means there are many more function entry points set up to run easily in the fuzzer. The culture of testing also probably means the person setting up the fuzzer test was willing to do more to expose more functions to the fuzzer.

      In contrast, much of the libreoffice code base is involved in user interaction and is highly context dependent. This doesn't make it a good target for the OSS-Fuzz framework. I'm guessing the libreoffice functions that are being fuzzed are low-level calculation functions or file-format parsers. The UI elements or the functions which work on the document as a whole? Probably not so much. I'm also guessing the different culture around testing probably also means that less effort was expended in exposing various functions to the fuzzer.

      tl:dr; - No direct knowledge of the details, but the libreoffice fuzzing is probably testing less code than the sqlite one, and hence finds correspondingly fewer bugs.

  • by Anonymous Coward on Saturday May 13, 2017 @11:23AM (#54410839)

    See subject: An inferior competitor, hostsman, does (& it's what I've warned of using others' libs - bugs). You must wait out a fix (IF it happens).

    THIS ARTICLE PROVES MY POINT!

    Hostsman also is stuck in 32-bit (mine does both 32/64-bit) & doesn't do hardcoded favorites where you spend most time online resolving faster locally in system RAM via hosts @ TOP of hosts (for fastest resolution) - mine does & is SINGLE "standalone" .exe portable multithreaded design (no dependence on BUGGY SQLite!!!).

    * For the BEST hosts file program? Accept NO substitute APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ [google.com]

    APK

    P.S.=> I won't "openSORES" it either - ask Google about EFast (it's my main reason why - a malicious doppleganger created from Chrome's openSORES code)... apk

    • by Brockmire ( 4931623 ) on Saturday May 13, 2017 @02:44PM (#54411515)
      Because you have a backdoor in it. Or just embarrassed by how shitty your code is.
    • by Anonymous Coward on Saturday May 13, 2017 @08:03PM (#54412315)
      What do you mean "portable, multi-threaded design", I just saw you rip in to someone not too long ago suggesting you process your hosts list in a background thread to prevent your UI from becoming non-responsive and you stated that it was impossible since the VCL was not threadsafe. Come back when you get an education moron, and you won't need to ask developers why they would rather use C than Object Pascal for one of the most stable and respected databases on the planet. You have no clue what you are even fucking talking about in almost every post you make.
      • by Anonymous Coward on Sunday May 14, 2017 @11:24AM (#54414317)

        It spawns up to 8 added threads for reverse DNS of fav sites where you spend most time (speeds up resolution locally from system RAM as hosts is cached & it is, it's just a file & PROTECTS YOU VS. DNS down (see China's "imitation=sincerest form of flattery" to my credit using hosts that way LONG before them http://www.theregister.co.uk/2017/04/26/boffins_supercharge_the_hosts_file_to_save_users_plagued_by_dns_outages/ [theregister.co.uk] OR vs. DNS numerous security & inefficiency issues galore https://news.slashdot.org/comments.pl?sid=9007355&threshold=-1&commentsort=0&mode=thread&pid=51969075/ [slashdot.org] )

        * I'm move my program around in AeroGlass in Win7 easily - under GDI/Win32 the progressbars work just fine also!

        (YOU PROJECT YOU DON'T KNOW WHAT YOU'RE TALKING ABOUT troll "ne'er-do-well" + You're welcome to do BETTER but you can't)

        APK

        P.S.=> VCL != threadsafe. I do my non-visible work in StringLists + reverse DNS code on threads (non-VCL)... apk

      • by Anonymous Coward on Sunday May 14, 2017 @11:35AM (#54414369)

        See subject (says it all) & blowing you away on threadwork https://it.slashdot.org/comments.pl?sid=10606043&cid=54414317/ [slashdot.org] was just "too, Too, TOO EASY - just '2ez'" bullshit artist UNIDENTIFIABLE anonymous troll! Yes, My program is also PORTABLE & multithreaded (effective where it matters & YOU LOSE on VCL fool (I don't thread that part)).

        * Using C has EXACTLY the problem I noted in it - null terminated strings open the possibility of BUFFER OVERFLOW EXPLOITS fool!

        (Pascal has NO SUCH PROBLEM - string length is already incorporated in its stringhandling - no having to use added slowups of strlen check functions (ala sending 2 pointers thru the character array of the string & 1 is double the size of the other, when the larger no longer advances you have midpoint - double that for length of string vs. buffer overflow of data inputs)).

        * Stable & RESPECTED? More like it had BUGS for 17++ yrs.! I want to know how to replace the OLD buggy one w/ his new patch in my browser!

        It's why I contacted him but he RAN!

        APK

        P.S.=> Point-blank - YOU don't have the BRAINS to take me on - between THIS post & the one in the link above? Give up chump - & if you haven't noticed? Dr. Hipp RAN from this from me too https://it.slashdot.org/comments.pl?sid=10606043&cid=54411183/ [slashdot.org] - "Gosh, I wonder WHY?" (not)... apk

    • by Anonymous Coward on Monday May 15, 2017 @02:04PM (#54420611)
      Untrue, in SQLite you are free to fix any problems you wish as the code is public domain. Unlike a closed source application such as your own which leaves the user completely at your mercy.
      • by Anonymous Coward on Monday May 15, 2017 @02:11PM (#54420661)

        See subject: I asked Dr. Hipp that but he RAN! How about an inferior competitor of mine that uses SQLite (hostsman)? Opera USES SQLite (buggy model as this article PROVES).

        * My code STAYS CLOSED - I'm not as DUMB as Google was (witness Chrome "EFast" misuse of Chrome code for malware!).

        WHEN A LIB or body of CODE goes bad as SQLite has shown it has? USERS, even myself, ARE @ THEIR TURNAROUND TIME & SUPPORT MERCY!

        (Not the other way around, but "nice try" (not) pulling your crap - & answer my question above!)

        APK

        P.S.=> Since I publicly released my program in 2012 not a SINGLE security issue OR even a BUG has come up & IF it did? I'd be on it like "white on rice" & fix it quickly (ask Mr. Steven Burn of Malwarebytes' hpHosts how FAST I am @ patches - clue: SAME DAY usually, it's my code, I get it completely)... apk

  • by nyet ( 19118 ) on Saturday May 13, 2017 @11:32AM (#54410863) Homepage

    What does this do that libasan and clang's scan-build don't?

  • by Anonymous Coward on Saturday May 13, 2017 @11:35AM (#54410875)

    Sikulix would be a great candidate. It's open source testing automation, has a few bugs / glitches in it, but still works.

  • by WaffleMonster ( 969671 ) on Saturday May 13, 2017 @11:44AM (#54410915)

    It seems all Google is doing is executing LibFuzzer. I'm unsure what value Google is bringing to the table here other than public attention whoring. They demand you give their bot credit for finding vulnerabilities. What about giving credit to the people who actually wrote the software?

    • by Anonymous Coward on Saturday May 13, 2017 @12:32PM (#54411091)

      It was mentioned what 3rd party tools were being used. What do you expect a front page NYT article? I'm sure on the description pages google gives proper attribution. This article is about the google service availability.

    • by Dutch Gun ( 899105 ) on Saturday May 13, 2017 @05:58PM (#54412039)

      Few others can devote such intense, continuous computational resources to finding bugs. Fuzz testing relies on a lot of brute-force computational power to test such a unfathomable number of potential test permutations, and it seems like this is essentially what they're providing.

      Given how many bugs they've found, I'd call "promotion of a worthwhile service" rather than "attention whoring". I mean, Google is essentially sponsoring projects to help make them more secure.

      I understand your point about attribution, but I think you're underestimating Google's contribution as well.

  • You're not using their software or platforms to develop, so of course they find issues. Let a third party check Google's stuff for bugs, oh that's right....most of the code that matters you can't look at, the big and thankful difference between FOSS and table scrap API's.
  • by Anonymous Coward on Saturday May 13, 2017 @01:12PM (#54411217)

    See subject: An inferior competitor, hostsman, does (& it's what I've warned of using others' libs or code - bugs). You must wait out a fix (IF it happens).

    THIS ARTICLE PROVES MY POINT!

    Hostsman is also stuck in 32-bit ONLY (mine does both 32/64-bit) & doesn't do hardcoded favorites where you spend most time online resolving faster locally in system RAM via hosts @ TOP of hosts (for fastest resolution) - mine does & is SINGLE "standalone" .exe portable multithreaded design (no dependence on BUGGY SQLite!!!).

    * For the BEST hosts file program? Accept NO substitute APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ [google.com]

    APK

    P.S.=> I won't "openSORES" it either - ask Google about EFast (it's my main reason why - a malicious doppleganger created from Chrome's openSORES code)... apk

  • by Anonymous Coward on Saturday May 13, 2017 @01:52PM (#54411357)

    This is great news, that solution has consistently been problem, going back years. Its good to see its finally getting some attention.

  • by UnknownSoldier ( 67820 ) on Saturday May 13, 2017 @03:03PM (#54411561)

    At least in the open source you a) KNOW about the bugs, and b) can fix them.

    In closed source bugs can remain hidden for DECADES. [wikipedia.org]

    i.e. The WMF bug was fixed in 2006 but has existed since the Windows 3.x days (1990).

  • by Anonymous Coward on Saturday May 13, 2017 @04:42PM (#54411855)

    See subject: An inferior competitor hostsman does (& it's what I've warned of using others' libs/code - bugs). You must wait out a fix (IF it happens).

    THE ARTICLE PROVES MY POINT!

    Hostsman is stuck in 32-bit ONLY (mine does both 32/64-bit) & doesn't do hardcoded favorites where you spend most time online resolving faster locally in system RAM via hosts @ TOP of hosts (for fastest resolution) & protecting you vs. DNS level tracking + security issues dns has - mine does & is SINGLE "standalone" .exe portable multithreaded design (no dependence on BUGGY SQLite).

    * BEST hosts file program? Accept NO substitute APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ [google.com]

    APK

    P.S.=> I won't "openSORES" it - Google EFast = why (a malware created via Chrome's openSORES)... apk

As of next Thursday, UNIX will be flushed in favor of TOPS-10. Please update your programs.

Working...