2

Regarding the newly discovered vulnerability PrintNightmare CVE-2021-34527 that has existed for years without being discovered, currently affecting almost all versions of Windows, server and workstation alike, and for which there is no patch as of the time of this writing July 3rd 2021, the best recommendation currently is to disable the print spooler until further notice.

My main question is, are vulnerabilities like that discovered through random fuzzing or careful testing/input crafting?

If we rewind to the moment the vulnerable piece of code was written back then, was it something that could have been caught by a more experienced programmer, or not and this is just an unfortunate complex interaction in a complex system?

Hypothetically, could a vulnerability like that been resolved much earlier by making the print spooler source code open source, without necessarily making all of the operating system's source code open source? Would that outweigh the cost of the vulnerability that they have to deal with now for a proprietary source code company like Microsoft?

1 Answer 1

3

There are many ways that vulnerabilities are discovered. Random fuzzing is one, systematic testing is another. Sometimes something is discovered by accident ("when I print this PDF, always something strange happens") and testing goes from there on further. Also, known and unknown bugs are pushed further to see if they can be exploited for other purposes.

There is not a single way that discovers all vulnerabilities.

Sometimes the vulnerability is caused by a programmers inexperience. Sometimes by the time-pressure on the project. Sometimes by incorrect assumptions in collaborations (like assumptions about parameters).

The assumption that making it opensource would resolve the vulnerability is not necessarily correct. Look for example at the state of openssl before the fork of libressl. Also, many opensource projects also contain vulnerabilities. So it, might help, but it certainly is not the solution to ban all vulnerabilities.

1
  • 1
    Heartbleed is a perfect example of bug in open source software that existed for more than a decade.
    – Nelson
    Oct 20, 2021 at 3:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .