oss-sec mailing list archives
Re: Hanno Boeck found Heartbleed using afl + ASan!
From: Seth Arnold <seth.arnold () canonical com>
Date: Tue, 7 Apr 2015 13:35:48 -0700
On Tue, Apr 07, 2015 at 01:27:40PM -0700, Michal Zalewski wrote:
this or any comparably serious find. Today, I'm asking myself the same question about AFL. Was it too counterintuitive to set this up? Were there other barriers to entry? Can I fix this now?
Hanno's trick of storing TLS packets as files is clever, but doesn't scale far beyond testing handshakes of a handful of protocols, and that with some effort. If AFL could grow the ability to mangle socket-based inputs, it would probably be more applicable to many more services, and beyond just handshaking. I realize it's asking for a unicorn when we've already been given a pony, but there it is. Thanks
Attachment:
signature.asc
Description: Digital signature
Current thread:
- Hanno Boeck found Heartbleed using afl + ASan! David A. Wheeler (Apr 07)
- Re: Hanno Boeck found Heartbleed using afl + ASan! Michal Zalewski (Apr 07)
- Re: Hanno Boeck found Heartbleed using afl + ASan! Seth Arnold (Apr 07)
- Re: Hanno Boeck found Heartbleed using afl + ASan! David A. Wheeler (Apr 07)
- Re: Hanno Boeck found Heartbleed using afl + ASan! Michal Zalewski (Apr 07)
- Re: Hanno Boeck found Heartbleed using afl + ASan! David A. Wheeler (Apr 07)
- Re: Hanno Boeck found Heartbleed using afl + ASan! Michal Zalewski (Apr 07)