Project Goals

1. Develop a classification scheme for vulnerabilities that leads to tools designed to detect vulnerabilities, and close them;
2. Support this task by creating and maintaining a database of vulnerabilities.

Project Members

Papers and Talks

• "The Vulnerabilities Project," M. Bishop, presented to Intel, Portland, OR (July 1998). [HTML]
• "Writing Safe Privileged Programs," M. Bishop, Network Security 1997, New Orleans, LA (Oct. 1997). [PDF] [Postscript]
• "Information Survivability, Security, and Fault Tolerance," M. Bishop, position paper for the Information Survivability Workshop, electronic proceedings; this is paper #6 (Feb. 1997). [PDF] [Postscript]
• "An Isolated Network for Research," M. Bishop and L. T. Heberlein, Proceedings of the 19th National Information Systems Security Conference pp. 349-360 (Oct. 1996). [PDF] [Postscript]
• "Attack Class: Address Spoofing," L. T. Heberlein and M. Bishop, Proceedings of the 19th National Information Systems Security Conference pp. 371-377 (Oct. 1996) [PDF] [Postscript]
• "Classifying Vulnerabilities," M. Bishop, Nineteenth National Information Systems Security Conference, Baltimore, MD (Oct. 1996). [PDF] [Postscript]
• "A Critical Analysis of Vulnerability Taxonomies," M. Bishop and D. Bailey, Technical Report 96-11, Department of Computer Science, University of California at Davis (Sep. 1996). [PDF] [Postscript]
• "Checking for Race Conditions in File Accesses," M. Bishop and M. Dilger, Computing Systems 9(2) (Spring 1996) pp. 131-152. [PDF] [Postscript]
• "Adventures in Hackery," M. Bishop, System Administration, Networking, and Security Conference IV, Washington, DC (May 1996). [PDF] [Postscript]
• "Patch-and-Catch," M. Bishop, UNIFORUM, San Francisco, CA (Mar. 1996). [PDF] [Postscript]
• "UNIX Security: Threats and Solutions," M. Bishop SHARE 86.0, Anaheim, CA (Mar. 1996). [PDF] [Postscript]
• "Intruders and UNIX Security," M. Bishop, Network Security, Washington DC (Nov. 1995). [PDF] [Postscript]
• "Intruders and UNIX Security," M. Bishop, High Technology Crime Investigation Association Conference, San Antonio TX (Nov. 1995). [PDF] [Postscript]
• "Checking for Race Conditions in UNIX File Accesses," M. Bishop and M. Dilger, Technical Report 95-9, Department of Computer Science, University of California at Davis (Sep. 1995). [PDF] [Postscript]
• "Race Conditions, Files, and Security Flaws: or, The Tortoise and the Hare Redux," M. Bishop, Technical Report 95-8, Department of Computer Science, University of California at Davis (Sep. 1995). [PDF] [Postscript]
• "A Taxonomy of UNIX and Network Security Vulnerabilities," M. Bishop, Technical Report 95-10, Department of Computer Science, University of California at Davis (May 1995). [PDF] [Postscript]
• "How to Write a Setuid Program," M. Bishop, :login; 12(1) (Jan./Feb. 1986), [Postscript]

Meetings

• June 24, 1998: Agenda, Minutes
• July 1, 1998: no meeting
• July 8, 1998: Agenda, Minutes
• July 22, 1998:  Agenda, Minutes
• July 29, 1998:  Minutes
• August 5, 1998:  Agenda
• August 12, 1998:  Agenda
• November 6, 1998:  Minutes
• November 13, 1998:  Minutes
• November 20, 1998:  Minutes

Project Sponsors

	Data General graciously donated a DG/UX Aviion system running a B2-level version of the UNIX operating system. Among other things, we use this system to teach students how to run penetration tests.
	Intel provided a generous gift to help start us in studying vulnerabilities in the various Windows systems.
	Microsoft donated some software to run on the computer systems that Intel donated.
	Net Squared is funding some of our research, and its president, Todd Heberlein, works with us, enlivening our meetings and providing keen insights.
	Trident Data Systems provided funding to move much of the early work along, as well as useful conversations, discussions, and ideas throughout.

Database

• Goals and Design Criteria for the Database
• Policy on Access.
• The manual for entering new vulnerabilities and exploits.
• The vulnerabilities DTD.
• The attack tool DTD.
• The public HTML version of the vulnerabilities database.

Contact Information