Audit Findings

What protocol-aware fuzzing finds in real implementations. Each article takes one protocol or file format, reports the defects across every implementation tested and what they have in common, and names the Penzzer target and modules that reach each class. Implementations are not named, surfaces that produced nothing are published too, and what is shown is a sample of what the testing surfaces rather than the limit of Penzzer's coverage.

Eighty-Three Defects in Twenty SNMP Implementations: Length Decoding and the Community Check

We tested twenty SNMP implementations and uncovered 83 defects. Most of them are in two places: the BER length decoder, which is reached before any credential is examined, and the community check, which in six of the twenty runs after the decoder or not at all.

Forty-Eight Defects in Eleven STUN and TURN Implementations

STUN has one mechanism binding a response to the request that asked for it. Three of the eleven implementations we tested broke it. In total we uncovered 48 defects, and none of the eleven came back clean.

Forty-Seven Defects in Seven FTP Servers, Including the Data Channel

FTP opens a second connection for every transfer, and the oldest defect in the protocol is failing to check who shows up on it. We tested seven servers and uncovered 47 defects. Six of the seven accept a data connection from anybody, and six of the seven can be talked outside the directory they serve.

Findings From Seven Surfaces Where the Target Kept Answering

A campaign that watches only for process death reports a clean run on a target that answered incorrectly. These findings are drawn from seven surfaces where the defect fired, the target carried on answering, and a campaign watching for crashes would have filed the run as clean, including one parser that hands the defect to the application above it.

Forty-Six Defects Across Eleven Surfaces of One Streaming Stack

One C library collection parses MP4, Matroska, MPEG-TS, FLV, RTMP, RTSP, RTP, SDP, SIP, HLS and DASH. All eleven surfaces were tested and 46 defects came out. The validation that exists is written as assertions, and the build configuration anyone ships compiles them out.

Twenty-Three Defects in Three Memory-Safe DNS Implementations, None of Them Memory-Safety Defects

Two Go DNS forwarders and a Rust DNS server, across eleven surfaces, with 23 defects between them. Not one is an overflow. What takes the overflow's place is a cache that answers a question the client did not ask and a parser that does unbounded work on a legal message.

Uncover Hidden Vulnerabilities

Identify security flaws before attackers do, automatically and at scale with Penzzer's intelligent fuzzing engine.