A Quantitative Assessment Approach to COTS Component Security
Table 3
Testing results for six tested components.
ID
Fault injection factor
The number of vulnerabilities and its
Test result
Security level
01
IIV
2 (0.13, 0.13)
ThunderAgent_005.dll has two methods calling (GetInfoStruct(), GetTaskInfoStruc()) neglected the input parameter exception and generated security vulnerability. Then they resulted in program breakdown
0.7569
02
CIV, LSV, RSV
5 (0.1, 0.2, 0.1, 0.15, 0.2)
AcroPDF.dll did not correctly deal with the string parameters sent to function setPageMode(), LoadFile(), setLayoutMode() and setNamedDest() and the attribute src. It triggered memory destroyed and resulted in security vulnerability for executing any instruction.
0.4406
03
LSV, RSV, FSV
1 (0.64)
The function SetInfo() of GLItemCom.DLL ActiveX over trusted user input and did not check parameter’s length. It resulted in the point the virtual function covered.
0.36
04
LSV, RSV, FSV
1 (0.1)
Pdg2.dll did not deal with the sent parameter to Register (), if user sends the string over 256 bytes, it can trigger stack overflow and execute any code.
0.9
05
LSV, RSV, USV
1 (0.15)
GomManager object did not collectively deal with the first parameter of OpenURL() in IGomManager interface. If transmitting the long parameters over 500 bytes, it can trigger stack overflow to result in visiting the memory exception.
0.85
06
PSN, CIV, PIV, LSV, USV
5 (0.15, 0.15, 0.15, 0.15, 0.15)
5 methods of component existed security exception. The test case parameters implemented by input fault injection operator would result in buffer overflow, visiting beyond the scope, and memory leakage.
