Fuzzing Like It’s 1989

Summary: Trail of Bits reran Barton P. Miller's original fuzzing tools and 1995 random inputs against modern Ubuntu Linux utilities and still found crashes and hangs, including a segmentation fault in f2c triggered via the f77 wrapper and a deadlock in spell when a line exceeds ispell's 4096-byte read buffer. The original 1990 paper found 25-33% of utilities failing depending on platform, the 1995 follow-up ranged from 9%-33% with Linux at 9%, and the 1995 paper noted roughly 40% of bugs reported in 1990 were still present in their exact form five years later.
Why it matters: The same 1989 fuzzing code still breaks current Ubuntu utilities, and the 1995 finding that about 40% of reported bugs survived unchanged is the number to sit with: bugs found and reported do not reliably get fixed.

Read the original at Trail of Bits Blog ↗