Enhanced descriptions from Syndetics:

This essential book for all software developers--regardless of platform, language, or type of application--outlines the 19 deadly sins of software security and shows how to fix each one.

Table of contents provided by Syndetics

• Foreword (p. xv)
• Acknowledgments (p. xvii)
• Introduction (p. xix)
• 1 Buffer Overruns (p. 1)
• Overview of the Sin (p. 2)
• Affected Languages (p. 2)
• The Sin Explained (p. 3)
• Sinful C/C++ (p. 6)
• Related Sins (p. 8)
• Spotting the Sin Pattern (p. 9)
• Spotting the Sin During Code Review (p. 9)
• Testing Techniques to Find the Sin (p. 9)
• Example Sins (p. 10)
• CVE-1999-0042 (p. 10)
• CVE-2000-0389-CVE-2000-0392 (p. 11)
• CVE-2002-0842, CVE-2003-0095, CAN-2003-0096 (p. 11)
• CAN-2003-0352 (p. 12)
• Redemption Steps (p. 12)
• Replace Dangerous String Handling Functions (p. 12)
• Audit Allocations (p. 13)
• Check Loops and Array Accesses (p. 13)
• Replace C String Buffers with C++ Strings (p. 13)
• Replace Static Arrays with STL Containers (p. 13)
• Use Analysis Tools (p. 13)
• Extra Defensive Measures (p. 14)
• Stack Protection (p. 14)
• Non-executable Stack and Heap (p. 14)
• Other Resources (p. 15)
• Summary (p. 16)
• 2 Format String Problems (p. 17)
• Overview of the Sin (p. 18)
• Affected Languages (p. 18)
• The Sin Explained (p. 18)
• Sinful C/C++ (p. 21)
• Related Sins (p. 21)
• Spotting the Sin Pattern (p. 21)
• Spotting the Sin During Code Review (p. 22)
• Testing Techniques to Find the Sin (p. 22)
• Example Sins (p. 22)
• CVE-2000-0573 (p. 23)
• CVE-2000-0844 (p. 23)
• Redemption Steps (p. 23)
• C/C++ Redemption (p. 23)
• Extra Defensive Measures (p. 24)
• Other Resources (p. 24)
• Summary (p. 24)
• 3 Integer Overflows (p. 25)
• Overview of the Sin (p. 26)
• Affected Languages (p. 26)
• The Sin Explained (p. 26)
• Sinful C and C++ (p. 26)
• Sinful C# (p. 31)
• Sinful Visual Basic and Visual Basic .NET (p. 33)
• Sinful Java (p. 34)
• Sinful Perl (p. 34)
• Spotting the Sin Pattern (p. 35)
• Spotting the Sin During Code Review (p. 36)
• C/C++ (p. 36)
• C# (p. 38)
• Java (p. 38)
• Visual Basic and Visual Basic .NET (p. 38)
• Perl (p. 39)
• Testing Techniques to Find the Sin (p. 39)
• Example Sins (p. 39)
• Flaw in Windows Script Engine Could Allow Code Execution (p. 39)
• Integer Overflow in the SOAPParameter Object Constructor (p. 39)
• Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise (p. 40)
• Redemption Steps (p. 40)
• Extra Defensive Measures (p. 42)
• Other Resources (p. 42)
• Summary (p. 43)
• 4 SQL Injection (p. 45)
• Overview of the Sin (p. 46)
• Affected Languages (p. 46)
• The Sin Explained (p. 46)
• Sinful C# (p. 47)
• Sinful PHP (p. 48)
• Sinful Perl/CGI (p. 48)
• Sinful Java and JDBC (p. 49)
• Sinful SQL (p. 50)
• Related Sins (p. 51)
• Spotting the Sin Pattern (p. 52)
• Spotting the Sin During Code Review (p. 52)
• Testing Techniques to Find the Sin (p. 53)
• Example Sins (p. 54)
• CAN-2004-0348 (p. 54)
• CAN-2002-0554 (p. 55)
• Redemption Steps (p. 55)
• Validate All Input (p. 55)
• Never Use String Concatenation to Build SQL Statements (p. 55)
• PHP 5.0 and MySQL 4.1 or Later Redemption (p. 56)
• Perl/CGI Redemption (p. 57)
• Java Using JDBC Redemption (p. 58)
• ColdFusion Redemption (p. 59)
• SQL Redemption (p. 59)
• Extra Defensive Measures (p. 59)
• Other Resources (p. 59)
• Summary (p. 60)
• 5 Command Injection (p. 63)
• Overview of the Sin (p. 64)
• Affected Languages (p. 64)
• The Sin Explained (p. 64)
• Related Sins (p. 66)
• Spotting the Sin Pattern (p. 66)
• Spotting the Sin During Code Review (p. 66)
• Testing Techniques to Find the Sin (p. 68)
• Example Sins (p. 68)
• CAN-2001-1187 (p. 68)
• CAN-2002-0652 (p. 69)
• Redemption Steps (p. 69)
• Data Validation (p. 69)
• When a Check Fails (p. 71)
• Extra Defensive Measures (p. 72)
• Other Resources (p. 72)
• Summary (p. 72)
• 6 Failing to Handle Errors (p. 73)
• Overview of the Sin (p. 74)
• Affected Languages (p. 74)
• The Sin Explained (p. 74)
• Yielding Too Much Information (p. 74)
• Ignoring Errors (p. 74)
• Misinterpreting Errors (p. 75)
• Using Useless Error Values (p. 75)
• Handling the Wrong Exceptions (p. 75)
• Handling All Exceptions (p. 76)
• Sinful C/C++ (p. 76)
• Sinful C/C++ on Windows (p. 77)
• Sinful C++ (p. 78)
• Sinful C#, VB.NET, and Java (p. 78)
• Related Sins (p. 79)
• Spotting the Sin Pattern (p. 79)
• Spotting the Sin During Code Review (p. 79)
• Testing Techniques to Find the Sin (p. 80)
• Example Sin (p. 80)
• CAN-2004-0077 Linux Kernel do_mremap (p. 80)
• Redemption Steps (p. 80)
• C/C++ Redemption (p. 80)
• C#, VB.NET, and Java Redemption (p. 81)
• Other Resources (p. 82)
• Summary (p. 82)
• 7 Cross-Site Scripting (p. 83)
• Overview of the Sin (p. 84)
• Affected Languages (p. 84)
• The Sin Explained (p. 84)
• Sinful C/C++ ISAPI Application or Filter (p. 85)
• Sinful ASP (p. 85)
• Sinful ASP.NET Forms (p. 86)
• Sinful JSP (p. 86)
• Sinful PHP (p. 86)
• Sinful CGI Using Perl (p. 86)
• Sinful mod_perl (p. 87)
• Spotting the Sin Pattern (p. 87)
• Spotting the Sin During Code Review (p. 87)
• Testing Techniques to Find the Sin (p. 88)
• Example Sins (p. 89)
• IBM Lotus Domino Cross-Site Scripting and HTML Injection Vulnerabilities (p. 89)
• Oracle HTTP Server "isqlplus" Input Validation Flaws Let Remote Users Conduct Cross-Site Scripting Attacks (p. 90)
• CVE-2002-0840 (p. 90)
• Redemption Steps (p. 90)
• ISAPI C/C++ Redemption (p. 90)
• ASP Redemption (p. 91)
• ASP.NET Forms Redemption (p. 91)
• JSP Redemption (p. 92)
• PHP Redemption (p. 94)
• CGI Redemption (p. 95)
• mod_perl Redemption (p. 95)
• A Note on HTML Encode (p. 96)
• Extra Defensive Measures (p. 96)
• Other Resources (p. 97)
• Summary (p. 98)
• 8 Failing to Protect Network Traffic (p. 99)
• Overview of the Sin (p. 100)
• Affected Languages (p. 100)
• The Sin Explained (p. 100)
• Related Sins (p. 102)
• Spotting the Sin Pattern (p. 103)
• Spotting the Sin During Code Review (p. 103)
• Testing Techniques to Find the Sin (p. 106)
• Example Sins (p. 106)
• TCP/IP (p. 107)
• E-mail Protocols (p. 107)
• E*Trade (p. 107)
• Redemption Steps (p. 108)
• Low-Level Recommendations (p. 108)
• Extra Defensive Measures (p. 111)
• Other Resources (p. 111)
• Summary (p. 111)
• 9 Use of Magic URLs and Hidden Form Fields (p. 113)
• Overview of the Sin (p. 114)
• Affected Languages (p. 114)
• The Sin Explained (p. 114)
• Magic URLs (p. 114)
• Hidden Form Fields (p. 115)
• Related Sins (p. 115)
• Spotting the Sin Pattern (p. 115)
• Spotting the Sin During Code Review (p. 116)
• Testing Techniques to Find the Sin (p. 117)
• Example Sins (p. 118)
• CAN-2000-1001 (p. 118)
• MaxWebPortal Hidden Form Field Modification (p. 118)
• Redemption Steps (p. 118)
• Attacker Views the Data (p. 119)
• Attacker Replays the Data (p. 119)
• Attacker Predicts the Data (p. 121)
• Attacker Changes the Data (p. 122)
• Extra Defensive Measures (p. 123)
• Other Resources (p. 123)
• Summary (p. 123)
• 10 Improper Use of SSL and TLS (p. 125)
• Overview of the Sin (p. 126)
• Affected Languages (p. 126)
• The Sin Explained (p. 126)
• Related Sins (p. 129)
• Spotting the Sin Pattern (p. 130)
• Spotting the Sin During Code Review (p. 130)
• Testing Techniques to Find the Sin (p. 132)
• Example Sins (p. 132)
• E-mail Clients (p. 132)
• Safari Web Browser (p. 133)
• The Stunnel SSL Proxy (p. 133)
• Redemption Steps (p. 134)
• Choosing a Protocol Version (p. 134)
• Choosing a Cipher Suite (p. 135)
• Ensuring Certificate Validity (p. 136)
• Validating the Hostname (p. 137)
• Checking Certificate Revocation (p. 138)
• Extra Defensive Measures (p. 140)
• Other Resources (p. 140)
• Summary (p. 140)
• 11 Use of Weak Password-Based Systems (p. 143)
• Overview of the Sin (p. 144)
• Affected Languages (p. 144)
• The Sin Explained (p. 144)
• Related Sins (p. 146)
• Spotting the Sin Pattern (p. 146)
• Spotting the Sin During Code Review (p. 146)
• Password Content Policy (p. 147)
• Password Changes and Resets (p. 147)
• Password Protocols (p. 148)
• Password Handling and Storage (p. 148)
• Testing Techniques to Find the Sin (p. 149)
• Example Sins (p. 149)
• CVE-2005-1505 (p. 150)
• CVE-2005-0432 (p. 150)
• The TENEX Bug (p. 150)
• The Paris Hilton Hijacking (p. 151)
• Redemption Steps (p. 151)
• Multifactor Authentication (p. 152)
• Storing and Checking Passwords (p. 152)
• Guidelines for Choosing Protocols (p. 156)
• Guidelines for Password Resets (p. 156)
• Guidelines for Password Choice (p. 157)
• Other Guidelines (p. 158)
• Extra Defensive Measures (p. 158)
• Other Resources (p. 159)
• Summary (p. 159)
• 12 Failing to Store and Protect Data Securely (p. 161)
• Overview of the Sin (p. 162)
• Affected Languages (p. 162)
• The Sin Explained (p. 162)
• Weak Access Controls to "Protect" Secret Data (p. 162)
• Sinful Access Controls (p. 164)
• Embedding Secret Data in Code (p. 166)
• Related Sins (p. 166)
• Spotting the Sin Pattern (p. 166)
• Spotting the Sin During Code Review (p. 167)
• Testing Techniques to Find the Sin (p. 168)
• Example Sins (p. 170)
• CVE-2000-0100 (p. 171)
• CAN-2002-1590 (p. 171)
• CVE-1999-0886 (p. 171)
• CAN-2004-0311 (p. 171)
• CAN-2004-0391 (p. 171)
• Redemption Steps (p. 172)
• Use the Operating System's Security Technologies (p. 172)
• C/C++ Windows 2000 and Later Redemption (p. 173)
• ASP.NET 1.1 and Later Redemption (p. 175)
• C#.NET Framework 2.0 Redemption (p. 175)
• C/C++ Mac OS X v10.2 and Later Redemption (p. 175)
• Redemption with No Operating System Help (or Keeping Secrets Out of Harm's Way) (p. 176)
• A Note on Java and the Java KeyStore (p. 178)
• Extra Defensive Measures (p. 180)
• Other Resources (p. 180)
• Summary (p. 181)
• 13 Information Leakage (p. 183)
• Overview of the Sin (p. 184)
• Affected Languages (p. 184)
• The Sin Explained (p. 184)
• Side Channels (p. 185)
• TMI: Too Much Information! (p. 186)
• A Model for Information Flow Security (p. 188)
• Sinful C# (and Any Other Language) (p. 190)
• Related Sins (p. 190)
• Spotting the Sin Pattern (p. 190)
• Spotting the Sin During Code Review (p. 191)
• Testing Techniques to Find the Sin (p. 192)
• The Stolen Laptop Scenario (p. 192)
• Example Sins (p. 192)
• Dan Bernstein's AES Timing Attack (p. 192)
• CAN-2005-1411 (p. 193)
• CAN-2005-1133 (p. 193)
• Redemption Steps (p. 194)
• C# (and Other Languages) Redemption (p. 194)
• Network Locality Redemption (p. 195)
• Extra Defensive Measures (p. 195)
• Other Resources (p. 195)
• Summary (p. 196)
• 14 Improper File Access (p. 197)
• Overview of the Sin (p. 198)
• Affected Languages (p. 198)
• The Sin Explained (p. 198)
• Sinful C/C++ on Windows (p. 199)
• Sinful C/C++ (p. 199)
• Sinful Perl (p. 200)
• Sinful Python (p. 200)
• Related Sins (p. 200)
• Spotting the Sin Pattern (p. 201)
• Spotting the Sin During Code Review (p. 201)
• Testing Techniques to Find the Sin (p. 202)
• Example Sins (p. 202)
• CAN-2005-0004 (p. 202)
• CAN-2005-0799 (p. 202)
• CAN-2004-0452 and CAN-2004-0448 (p. 203)
• CVE-2004-0115 Microsoft Virtual PC for the Macintosh (p. 203)
• Redemption Steps (p. 203)
• Perl Redemption (p. 204)
• C/C++ Redemption on *nix (p. 204)
• C/C++ Redemption on Windows (p. 204)
• Getting the Location of the User's Temporary Directory (p. 205)
• .NET Code Redemption (p. 205)
• Extra Defensive Measures (p. 205)
• Other Resources (p. 206)
• Summary (p. 206)
• 15 Trusting Network Name Resolution (p. 207)
• Overview of the Sin (p. 208)
• Affected Languages (p. 208)
• The Sin Explained (p. 208)
• Sinful Applications (p. 210)
• Related Sins (p. 211)
• Spotting the Sin Pattern (p. 211)
• Spotting the Sin During Code Review (p. 212)
• Testing Techniques to Find the Sin (p. 212)
• Example Sins (p. 212)
• CVE-2002-0676 (p. 213)
• CVE-1999-0024 (p. 213)
• Redemption Steps (p. 213)
• Other Resources (p. 214)
• Summary (p. 215)
• 16 Race Conditions (p. 217)
• Overview of the Sin (p. 218)
• Affected Languages (p. 218)
• The Sin Explained (p. 218)
• Sinful Code (p. 220)
• Related Sins (p. 220)
• Spotting the Sin Pattern (p. 221)
• Spotting the Sin During Code Review (p. 221)
• Testing Techniques to Find the Sin (p. 222)
• Example Sins (p. 222)
• CVE-2001-1349 (p. 222)
• CAN-2003-1073 (p. 223)
• CVE-2000-0849 (p. 223)
• Redemption Steps (p. 223)
• Extra Defensive Measures (p. 225)
• Other Resources (p. 225)
• Summary (p. 226)
• 17 Unauthenticated Key Exchange (p. 227)
• Overview of the Sin (p. 228)
• Affected Languages (p. 228)
• The Sin Explained (p. 228)
• Related Sins (p. 229)
• Spotting the Sin Pattern (p. 230)
• Spotting the Sin During Code Review (p. 230)
• Testing Techniques to Find the Sin (p. 231)
• Example Sins (p. 231)
• Novell Netware MITM Attack (p. 231)
• CAN-2004-0155 (p. 231)
• Redemption Steps (p. 232)
• Extra Defensive Measures (p. 232)
• Other Resources (p. 233)
• Summary (p. 233)
• 18 Cryptographically Strong Random Numbers (p. 235)
• Overview of the Sin (p. 236)
• Affected Languages (p. 236)
• The Sin Explained (p. 236)
• Sinful NonCryptographic Generators (p. 237)
• Sinful Cryptographic Generators (p. 237)
• Sinful True Random Number Generators (p. 238)
• Related Sins (p. 239)
• Spotting the Sin Pattern (p. 239)
• Spotting the Sin During Code Review (p. 239)
• When Random Numbers Should Have Been Used (p. 239)
• Finding Places that Use PRNGs (p. 240)
• Determining Whether a CRNG Is Seeded Properly (p. 241)
• Testing Techniques to Find the Sin (p. 241)
• Example Sins (p. 242)
• The Netscape Browser (p. 242)
• OpenSSL Problems (p. 242)
• Redemption Steps (p. 243)
• Windows (p. 243)
• .NET Code (p. 243)
• Unix (p. 244)
• Java (p. 245)
• Replaying Number Streams (p. 245)
• Extra Defensive Measures (p. 246)
• Other Resources (p. 246)
• Summary (p. 246)
• 19 Poor Usability (p. 247)
• Overview of the Sin (p. 248)
• Affected Languages (p. 248)
• The Sin Explained (p. 248)
• Who Are Your Users? (p. 249)
• The Minefield: Presenting Security Information to Your Users (p. 249)
• Related Sins (p. 250)
• Spotting the Sin Pattern (p. 250)
• Spotting the Sin During Code Review (p. 250)
• Testing Techniques to Find the Sin (p. 251)
• Example Sins (p. 251)
• SSL/TLS Certificate Authentication (p. 251)
• Internet Explorer 4.0 Root Certificate Installation (p. 252)
• Redemption Steps (p. 253)
• When Users Are Involved, Make the UI Simple and Clear (p. 253)
• Make Security Decisions for Users (p. 253)
• Make Selective Relaxation of Security Policy Easy (p. 255)
• Clearly Indicate Consequences (p. 255)
• Make It Actionable (p. 258)
• Provide Central Management (p. 259)
• Other Resources (p. 259)
• Summary (p. 259)
• A Mapping the 19 Deadly Sins to the OWASP "Top Ten" (p. 261)
• B Summary of Do's and Don'ts (p. 263)
• Sin 1 Buffer Overruns Summary (p. 264)
• Sin 2 Format String Problems Summary (p. 264)
• Sin 3 Integer Overflows Summary (p. 264)
• Sin 4 SQL Injection Summary (p. 265)
• Sin 5 Command Injection Summary (p. 266)
• Sin 6 Failing to Handle Errors Summary (p. 266)
• Sin 7 Cross-Site Scripting Summary (p. 266)
• Sin 8 Failing to Protect Network Traffic Summary (p. 266)
• Sin 9 Use of Magic URLs and Hidden Form Fields Summary (p. 267)
• Sin 10 Improper Use of SSL and TLS Summary (p. 267)
• Sin 11 Use of Weak Password-Based Systems Summary (p. 268)
• Sin 12 Failing to Store and Protect Data Securely Summary (p. 269)
• Sin 13 Information Leakage Summary (p. 270)
• Sin 14 Improper File Access Summary (p. 270)
• Sin 15 Trusting Network Name Resolution Summary (p. 270)
• Sin 16 Race Conditions Summary (p. 271)
• Sin 17 Unauthenticated Key Exchange Summary (p. 271)
• Sin 18 Cryptographically Strong Random Numbers Summary (p. 271)
• Sin 19 Poor Usability Summary (p. 271)
• Index (p. 273)