Vulnerability in widely used ‘strings’ utility could spell trouble for malware analysts

One of the first things a malware analyst does when encountering a suspicious executable file is to extract the text strings found inside it, because they can provide immediate clues about its purpose. This operation has long been considered safe, but it can actually lead to a system compromise, a security researcher found.

String extraction is typically done using a Linux command-line tool called strings that’s part of GNU Binutils, a collection of tools for binary file analysis and manipulation available by default in most Linux distributions.

Google security engineer Michal Zalewski was recently running a type of vulnerability testing known as fuzzing against a library called libbfd (the Binary File Descriptor library) that sits at the core of GNU Binutils and is used for file format parsing. Fuzzing is the act of providing unexpected input to an application like libbfd in order to trigger potentially exploitable behavior.

To read this article in full or to leave a comment, please click here