Danish security company Secunia revealed July 1 that many popular
third-party Windows applications are not taking advantage of two built-in
Windows security measures that could help defend against code execution attacks.
According to Secunia, applications such as Sun Java JRE, Apple QuickTime and
RealPlayer are not making use of Microsoft's DEP (Data Execution Prevention)
and ASLR (Address Space Layout Randomization) technologies. The report,
entitled DEP/ASLR
Implementation Progress in Popular Third-Party Windows Applications, (PDF)
analyzed the way 16 popular applications use—or don't use—DEP or ASLR, and
whether that has changed over time.
DEP was first added to Windows in Windows XP Service Pack 2 in August of
2004, and prevents applications from executing code from a nonexecutable
memory region. Microsoft added ASLR
to Windows Vista in 2007. ASLR randomizes memory space to lower the
chance of an attacker successfully executing code.
"DEP and ASLR make it harder and in some cases impossible to exploit
certain vulnerabilities," explained Thomas Kristensen, chief security
officer of Secunia.
Though some developers have
made their applications compatible with DEP over time—as is the case with
Adobe Reader, for example—overall adoption has been slow and uneven between
operating system versions. ASLR support, on the other hand, is improperly
implemented by almost all vendors, allowing return-into-libc techniques to likely
succeed in their applications or in browsers designed to otherwise be ASLR-compliant,
the researchers wrote.
Kristensen said he was not sure why adoption of the technologies has been
slow.
"There is no obvious answer; the technologies are well documented, DEP
has been around since XP SP2 and ASLR since Vista,"
he said. "It is probably due to general lack of awareness and
understanding amongst developers and managers in many of these companies."
He added, "Another reason may be that they don't understand the need
for DEP and ASLR in all code [libraries] used—one library not using DEP/ASLR
will in many cases void the efforts."
Kristensen said he expects that adoption of the technologies will increase
in the future.
"While it isn't a replacement for writing proper secure code ...
DEP/ASLR can certainly save them in many cases," he said.
IT Security & Network Security News & Reviews News & Reviews 
