Updated Writing Secure Code 2nd Ed Errata


Big thanks to Peter Gutmann and Morten Andersen for their comments.I have highlighted what’s new in RED.


Errata for Writing Secure Code 2nd Edition


By Michael Howard and David LeBlanc


Last Updated 2-Jun-2004


 


Entire Book


Please replace all references to Windows® .NET Server with Windows® Server 2003.


 


Chapter 2, Page 44


There is a small typo:


 


This effect is called the Hawthorn effect.


 


          Should read:


 


This effect is called the Hawthorne effect.


 


Chapter 8, Page 276


There’s a small typo in the right column of Figure 8-3:


 


hKey = GetKey(“MyKey”);


 


Should read


 


hKey = GetKeyHandle(“MyKey”);


 


Chapter 8, Page 284


The sentence that starts “DES encrypts the first eight bytes and then pads the remaining five bytes with three bytes, usually null” requires more explanation. Usually, the extra n-bytes are padded with value n. So if there are five extra bytes that require padding, they are padded with five bytes of value 0x05.


 


Chapter 8, Page 295


There is a small type:


 


However, if you want to access a certificate a private key stored by CryptoAPI


 


          Should read:


 


However, if you want to access a certificate or a private key stored by CryptoAPI


 


Chapter 9, Page 302


In the code sample, the lines:


                                                  


BYTE *pbSaltedHash = new BYTE[cbSaltedHash];


if (NULL == *pbSaltedHash) throw;


 


Should read


 


BYTE *pbSaltedHash = new BYTE[cbSaltedHash];


if (NULL == pbSaltedHash) throw;


 


Also, this code is labeled as C/C++ code; it is in fact C++ code.


 


Chapter 9, Page 304


In the code sample, the line:


                                                  


return p.GetBytes(16);


 


Should read


 


return p.GetBytes(20);


 


Chapter 9, Page 322


There is a small typo in the #define at the top of the page.


 


#define RtlZeroMemory(Destination,Length) –


     memset((Destination),0,(Length))


 


Should read:


 


#define RtlZeroMemory(Destination,Length) \


     memset((Destination),0,(Length))


 


Chapter 9, Page 322


The assembly language listing has lost whitespace, for example pusheax should read push eax, the corrected listing is:


 


; 30   : void DatabaseConnect(char *szDB) {


 


     sub  esp, 68                      ; 00000044H


     mov  eax, DWORD PTR ___security_cookie


     xor  eax, DWORD PTR __$ReturnAddr$[esp+64]


 


; 31   :     char szPwd[64];


; 32   :     if (GetPasswordFromUser(szPwd,sizeof(szPwd))) {


 


     push 64                      ; 00000040H


     mov  DWORD PTR __$ArrayPad$[esp+72], eax


     lea  eax, DWORD PTR _szPwd$[esp+72]


     push eax


     call GetPasswordFromUser


     add  esp, 8


     test al, al


     je   SHORT $L1344


 


; 33   :         if (ConnectToDatabase(szDB, szPwd)) {


 


     mov  edx, DWORD PTR _szDB$[esp+64]


     lea  ecx, DWORD PTR _szPwd$[esp+68]


     push ecx


     push edx


     call ConnectToDatabase


     add  esp, 8


$L1344:


 


; 34   :             // Cool, we’re connected


; 35   :             // Now do database stuff


; 36   :         }


; 37   :     }


; 38   :


; 39   :     ZeroMemory(szPwd,sizeof(szPwd));


; 40   : }


 


     mov  ecx, DWORD PTR __$ArrayPad$[esp+68]


     xor  ecx, DWORD PTR __$ReturnAddr$[esp+64]


     add  esp, 68                      ; 00000044H


     jmp  @__security_check_cookie@4


DatabaseConnect ENDP


 


Chapter 10, Page 350


There is an error in the C# and Perl regular expressions used to determine if a file extension is valid.


 


In both cases the expression:


 


txt|rtf|gif|jpg|bmp$


 


Should read:


 


(?:txt|rtf|gif|jpg|bmp)$


 


Chapter 11, Page 387


There is an error in the note at the top of the page; simply stat’ing a file in Linux/Unix is not safe. There’s a nice write up in Viega/McGraw’s Building Secure Software about how to do this properly. The chapter is also available online at http://www.awprofessional.com/articles/article.asp?p=23947&seqNum=3.



 


Chapter 16, Page 492


If a privacy level protection is set on an RPC binding handle or a protocol sequence that always provides private communication is used (like ncalrpc), context handles are no longer subject to hijacking starting with Windows Server 2003 and Windows 2000 SP4.


 


Chapter 16, Page 495


Starting with Windows XP and Windows Server 2003, RpcServerInqCallAttributes is recommended over RpcBindingInqAuthClient as it is faster, more versatile and lends itself to future extensions because of built-in versioning.


 


Chapter 16, Page 496


You can also set a flag, RPC_IF_ALLOW_SECURE_ONLY, on the call to RpcServerRegisterIfEx and RpcServerRegisterIf2 to allow only secured connections.


 


Should read:


 


If all you want to do is reject unauthenticated connections, you can set a flag, RPC_IF_ALLOW_SECURE_ONLY, on the call to RpcServerRegisterIfEx and RpcServerRegisterIf2 to allow only secured connections instead of using a security callback.


 


Chapter 16, Page 497


Add the following text prior to the paragraph that starts, “It is preferable”


 


However, using this flag has one important limitation – it tells you nothing about who the user is. To pass the check imposed by this flag, the client simply has to have valid authentication information. If you have low privileged accounts on your server (like guest), using this flag will not reject requests by these users. If there is any account enabled on the machine that you don’t want to accept requests from, you should use a security callback function and check for user identity.


 


Chapter 16, Page 515


The registry subkey to set an ActiveX killbit is misspelled.


 


ActiveX Compatability


 


Should read:


 


ActiveX Compatibility


 


Chapter 18, Page 535


A friend told me I would soon by out of a job


 


Should read:


 


A friend told me I would soon be out of a job


 


Chapter 18, Page 544


PermMaximum È (PermMinimum Ç PermOptional)) – PermRefused


 


Should read:


 


PermMaximum Ç (PermMinimum È PermOptional)) – PermRefused


 


Chapter 19, Page 549


There is an error in the C# sample code at the top of the page, the line reading:


 


new PermissionSet(PermissionState.Unrestricted);


 


Should read:


 


new PermissionSet(PermissionState.None);


 


Chapter 19, Page 550


There are two error in the C# sample code. In the SendAlert() function, the line reading:


 


CodeAccessPermission.RevertAssert();


 


Should read:


 


SocketPermission.RevertAssert();


 


And in the C() function


 


CodeAccessPermission.RevertAssert();


 


Should read:


 


FileIOPermission.RevertAssert();


 


Chapter 19, Page 587


is the Cenzic product named Hailstorm This tool allows a tester to construct


 


Is missing a period character, and should read:


 


is the Cenzic product named Hailstorm. This tool allows a tester to construct


 


Chapter 19, Page 596


There is a small, but important, typo in the first code sample:


 


# Note the use of back ticks – like calling system()


‘$exe $FILE’;


 


          Should read:


 


# Note the use of back ticks – like calling system()


`$exe $FILE`;


 


Chapter 19, Page 610


This leads to more complete test code, but even with broad test plans the test must code must be good quality,


 


Should read:


 


This leads to more complete test code, but even with broad test plans the test code must be good quality,


 


Chapter 23, Page 665


In the second bullet, SetThreatDesktop should read SetThreadDesktop.

Comments (2)

  1. Is there any place where I can see the differences between first and second edition of the book? I couldn’t find it.