Title: Certifying/verifying Software Compilation as a Solution to Asn.1 Implementations Vulnerabilities

CERT/CC identified vulnerabilities in SNMP and OpenSSL implementations related to the use of ASN.1. Ill-formed ASN.1 Tag/Length/Value (TLV) structures and weak parsers and decoders are responsible for most of these vulnerabilities and not the ASN.1 language itself. As a consequence, exploiting SNMP and OpenSSL vulnerabilities in an operating environment may lead to failures and denials of services. ASN.1 is used in a number of important protocols; therefore it is very important to ensure that ASN.1 implementations are safe. This contribution is presented for information sharing and to generate interest in the so-called language-based approach to security and certifying compilation techniques to ensure that a protocol implementation is safe before it is deployed in an operating environment.