DOCSLIB.ORG

Improving Web Application Security

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Improving Web Application Security Improving Web Application Security Threats and Countermeasures Forewords by Mark Curphey, Joel Scambray, and Erik Olson Improving Web Application Security Threats and Countermeasures patterns & practices J.D. Meier, Microsoft Corporation Alex Mackman, Content Master Srinath Vasireddy, Microsoft Corporation Michael Dunner, Microsoft Corporation Ray Escamilla, Microsoft Corporation Anandha Murukan, Satyam Computer Services Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft, MS-DOS, Windows, Windows NT, Active Directory, BizTalk, IntelliSense, MSDN, Visual Basic, Visual C#, Visual C++, and Visual Studio are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. © 2003 Microsoft Corporation. All rights reserved. Version 1.0 6/30/2003 The names of actual companies and products mentioned herein may be the trademarks of their respective owners. Contents Forewords xliii Foreword by Mark Curphey .....................................................................................xliii Foreword by Joel Scambray .....................................................................................xlv Foreword by Erik Olson .......................................................................................... xlvi Introduction xlix Why We Wrote This Guide .......................................................................................... xlix What Is a Hack-Resilient Application? .............................................................................l Scope of This Guide.....................................................................................................li Securing the Network, Host, and Application ..............................................................li Technologies in Scope............................................................................................. lii Who Should Read This Guide....................................................................................... lii How to Use This Guide ............................................................................................... liii Applying the Guidance to Your Role ......................................................................... liii Applying the Guidance to Your Product Life Cycle...................................................... liv Microsoft Solutions Framework ................................................................................ lv Organization of This Guide ........................................................................................... lv Solutions at a Glance.............................................................................................. lv Fast Track............................................................................................................... lv Parts..................................................................................................................... lvi Checklists .............................................................................................................lvii “How To” Articles..................................................................................................lviii Approach Used in This Guide .....................................................................................lviii Secure Your Network, Host, and Application ............................................................lviii Focus on Threats ................................................................................................... lix Follow a Principle-Based Approach............................................................................ lx Positioning of This Guide ............................................................................................. lx Volume I, Building Secure ASP.NET Applications ........................................................ lx Volume II, Improving Web Application Security .......................................................... lxi Feedback and Support ...............................................................................................lxii Feedback on the Guide...........................................................................................lxii Technical Support ..................................................................................................lxii Community and Newsgroup Support ........................................................................lxii The Team Who Brought You This Guide .......................................................................lxiii Contributors and Reviewers ...................................................................................lxiii Tell Us About Your Success........................................................................................ lxiv Summary ................................................................................................................. lxiv vi Improving Web Application Security: Threats and Countermeasures Solutions at a Glance lxv Architecture and Design Solutions...............................................................................lxv Development Solutions ............................................................................................. lxvi Administration Solutions.............................................................................................lxx Fast Track — How To Implement the Guidance lxxv Goal and Scope ....................................................................................................... lxxv The Holistic Approach...............................................................................................lxxvi Securing Your Network.............................................................................................lxxvii Securing Your Host..................................................................................................lxxvii Securing Your Application .......................................................................................lxxviii Identify Threats........................................................................................................lxxix Applying the Guidance to Your Product Life Cycle........................................................lxxxi Implementing the Guidance .....................................................................................lxxxii Who Does What? ...................................................................................................lxxxiii RACI Chart ........................................................................................................lxxxiii Summary .............................................................................................................. lxxxiv Part I Introduction to Threats and Countermeasures 1 Chapter 1 Web Application Security Fundamentals 3 We Are Secure — We Have a Firewall ............................................................................ 3 What Do We Mean By Security? ................................................................................... 4 The Foundations of Security..................................................................................... 4 Threats, Vulnerabilities, and Attacks Defined................................................................. 5 How Do You Build a Secure Web Application?................................................................ 5 Secure Your Network, Host, and Application .................................................................. 6 Securing Your Network................................................................................................. 7 Network Component Categories ............................................................................... 7 Securing Your Host...................................................................................................... 7 Host Configuration Categories.................................................................................. 8 Securing Your Application ............................................................................................ 9 Application Vulnerability Categories .......................................................................... 9 Security Principles..................................................................................................... 11 Summary ................................................................................................................. 12 Additional Resources ................................................................................................ 12 Chapter 2 Threats and Countermeasures 13 In This Chapter ........................................................................................................
Load more

Recommended publications
  • Classification of Malware Models Akriti Sethi San Jose State University
    San Jose State University SJSU ScholarWorks Master's Projects Master's Theses and Graduate Research Spring 5-20-2019 Classification of Malware Models Akriti Sethi San Jose State University Follow this and additional works at: https://scholarworks.sjsu.edu/etd_projects Part of the Artificial Intelligence and Robotics Commons, and the Information Security Commons Recommended Citation Sethi, Akriti, "Classification of Malware Models" (2019). Master's Projects. 703. DOI: https://doi.org/10.31979/etd.mrqp-sur9 https://scholarworks.sjsu.edu/etd_projects/703 This Master's Project is brought to you for free and open access by the Master's Theses and Graduate Research at SJSU ScholarWorks. It has been accepted for inclusion in Master's Projects by an authorized administrator of SJSU ScholarWorks. For more information, please contact [email protected]. Classification of Malware Models A Project Presented to The Faculty of the Department of Computer Science San José State University In Partial Fulfillment of the Requirements for the Degree Master of Science by Akriti Sethi May 2019 © 2019 Akriti Sethi ALL RIGHTS RESERVED The Designated Project Committee Approves the Project Titled Classification of Malware Models by Akriti Sethi APPROVED FOR THE DEPARTMENT OF COMPUTER SCIENCE SAN JOSÉ STATE UNIVERSITY May 2019 Dr. Mark Stamp Department of Computer Science Dr. Thomas Austin Department of Computer Science Dr. Philip Heller Department of Computer Science ABSTRACT Classification of Malware Models by Akriti Sethi Automatically classifying similar malware families is a challenging problem. In this research, we attempt to classify malware families by applying machine learning to machine learning models. Specifically, we train hidden Markov models (HMM) for each malware family in our dataset.
    [Show full text]
  • Securing Enterprise Web Applications at the Source: an Application Security Perspective
    Securing Enterprise Web Applications at the Source: An Application Security Perspective Author: Eugene Lebanidze [email protected] EXECUTIVE SUMMARY Purpose: This paper considers a variety of application level threats facing enterprise web applications and how those can be mitigated in order to promote security. Evidence shows that perhaps as many as sixty percent of attacks on enterprise web applications are facilitated by exploitable vulnerabilities present in the source code. In this paper we take the approach of examining the various threats specific to the application layer along with their corresponding compensating controls. Threats specific to each of the tiers of the n- tiered enterprise web application are discussed with focus on threat modeling. Compensating controls are addressed at the architecture, design, implementation and deployment levels. The discussion focuses around the core security services, namely confidentiality, integrity, authentication, authorization, availability, non-repudiation and accountability. The paper examines how these core security services are supported in the J2EE and .NET frameworks. Recommendations and standards from various organizations are considered in this paper (e.g. OWASP, NIST, etc.) We also recognize that development and deployment of a secure enterprise web-based application is dependent upon the organization’s enterprise security architecture (ESA) framework. Therefore, we map some elements of our discussion for security architecture and technology issues to the five rings of the enterprise security architecture model, particularly in the context of the Zachman Framework enterprise architecture (EA). While most of the web application security threats and mitigations discussed fall in rings four and five, we tie the local risk to the enterprise risk in ring one of the ESA.
    [Show full text]
  • Security and Survivability Reasoning Frameworks and Architectural Design Tactics
    Security and Survivability Reasoning Frameworks and Architectural Design Tactics Robert J. Ellison Andrew P. Moore Len Bass Mark Klein Felix Bachmann September 2004 Network Systems Survivability Software Architecture Technology Unlimited distribution subject to the copyright. Technical Note CMU/SEI-2004-TN-022 This work is sponsored by the U.S. Department of Defense. The Software Engineering Institute is a federally funded research and development center sponsored by the U.S. Department of Defense. Copyright 2004 Carnegie Mellon University. NO WARRANTY THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder. Internal use. Permission to reproduce this document and to prepare derivative works from this document for internal use is granted, provided the copyright and “No Warranty” statements are included with all reproductions and derivative works. External use. Requests for permission to reproduce this document or prepare derivative works of this document for external and commercial use should be addressed to the SEI Licensing Agent. This work was created in the performance of Federal Government Contract Number F19628-00-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center.
    [Show full text]
  • A Hierarchical Approach for Useable and Consistent CAPEC-Based Attack Patterns Patrick H
    Dakota State University Beadle Scholar Masters Theses & Doctoral Dissertations Spring 3-1-2009 A Hierarchical Approach for Useable and Consistent CAPEC-based Attack Patterns Patrick H. Engebretson Dakota State University Follow this and additional works at: https://scholar.dsu.edu/theses Recommended Citation Engebretson, Patrick H., "A Hierarchical Approach for Useable and Consistent CAPEC-based Attack Patterns" (2009). Masters Theses & Doctoral Dissertations. 274. https://scholar.dsu.edu/theses/274 This Dissertation is brought to you for free and open access by Beadle Scholar. It has been accepted for inclusion in Masters Theses & Doctoral Dissertations by an authorized administrator of Beadle Scholar. For more information, please contact [email protected]. A HIERARCHICAL APPROACH FOR USEABLE AND CONSISTENT CAPEC-BASED ATTACK PATTERNS A dissertation submitted to Dakota State University in partial fulfillment of the requirements for the degree of Doctorate of Science in Information Systems March, 2009 By Patrick H. Engebretson Dissertation Committee: Dr. Josh Pauli Dr. Kevin Streff Dr. Tom Halverson Dr. Rich Avery Dr. Surendra Sarnikar ii DISSERTATION APPROVAL FORM We certify that we have read this project and that, in our opinion, it is satisfactory in scope and quality as a project for the degree of Doctorate of Science in Information Systems. Student Name: Dissertation Title: Dissertation Chair: Date: Committee member: Date: Committee member: Date: Committee member: Date: iii ACKNOWLEDGEMENTS This dissertation is dedicated to all of those people who have played a part in its creation. I may have written the words, but I couldn‟t have completed it without the countless sacrifices of those around me. To my parents Marge and Larry Engebretson, both teachers, who taught me the value of hard work and worthiness of dedicating yourself to the education of others.
    [Show full text]
  • Honey-Patterns: Recognizing Pattern Based Attacks on Websites
    International Journal of Computer Applications (0975 – 8887) Volume 161 – No 9, March 2017 Honey-patterns: Recognizing Pattern based Attacks on Websites Prathamesh P. Churi Shreya Bondre Neha Gavankar Assistant Professor, Brand & Project Manager Information Security Computer Engineering Marketing Department Principal consultant Department SVKM’s Connoisseur Group NTT Data Americas NMIMS Mukesh Shanghai, China Halifax , Canada Patel School of Technology Management and Engineering Mumbai, India ABSTRACT itself. All this information is used to learn more about the The exact definition of a honeypot is contentious. However, black hat proceedings and motives as well as their technical the concept can be defined as “A server that is configured to knowledge, abilities and strategies used. This is just primary detect an intruder by mirroring a real production system. It purpose if honeypot. There are a lot of other possibilities for a appears as an ordinary server functioning normally, but all the honeypot-divert hackers form productive systems for catching data and transactions are phony. Located either in or outside a hacker while conducting an attack these are just two the firewall, the honeypot is used to learn about an intruder's possible examples [6]. techniques as well as determine the vulnerabilities of the Honeypots are not the perfect solution for solving or system" Honeypot is a closely monitored decoy that is preventing computer crimes. Honeypots are hard to maintain employed in networks to study the trail of hackers and to alert and they need the good knowledge about the operating network administrators of a possible intrusion. Honey net is a systems and network security [1] .
    [Show full text]
  • Attack–Defense Trees
    Attack–Defense Trees Patrick Schweitzer Supervisor: Prof. Dr. Sjouke Mauw (University of Luxembourg) Daily advisor: Dr. Barbara Kordy (University of Luxembourg) © 2013 Patrick Schweitzer The author was employed at the University of Luxembourg and received support from the Fonds National de la Recherche, Luxembourg (PHD-09-167) in the project “Security Analysis through Attack–Defense Trees”. PhD-FSTC-2013-28 The Faculty of Sciences, Technology and Communication DISSERTATION Presented on 8 November 2013 in Luxembourg to obtain the degree of DOCTEUR DE L’UNIVERSITÉ DU LUXEMBOURG EN INFORMATIQUE by Patrick SCHWEITZER Born on 25 January 1980 in Saarbrücken–Dudweiler (Germany) ATTACK–DEFENSE TREES Dissertation defense committee Dr. Barbara Kordy, vice-chairman Université du Luxembourg Dr. Sjouke Mauw, dissertation supervisor Professor, Université du Luxembourg Dr. Christian W. Probst, member Assistant Professor, The Technical University of Denmark Dr. Yves Le Traon, chairman Professor, Université du Luxembourg Dr. Jan Willemson, member Cybernetica, Estonia Summary The advent of the information age has notably amplified the importance of security. Unfortunately security considerations still widely occur as an afterthought. For many companies, security is not a requirement to conduct business and is therefore readily neglected. However the lack of security may obstruct, impede and even ruin an otherwise flourishing enterprise. Only when internal computer networks shut down, web portals are inaccessible, mail servers are attacked, or similar incidents affect the day to day business of an enterprise, security enters into the field of vision of companies. As such, security by design is only slowly becoming accepted practice. Amongst security researchers, there is no dispute that a reasonable approach to- wards uninterrupted business activities includes security measures and controls from the beginning.
    [Show full text]
  • Cyber Threat Modeling: Survey, Assessment, and Representative Framework
    Prepared for: Department of Homeland Security Cyber Threat Modeling: Survey, Assessment, and Representative Framework April 7, 2018 Authors: Deborah J. Bodeau Catherine D. McCollum David B. Fox The Homeland Security Systems Engineering and Development Institute (HSSEDI)™ Operated by The MITRE Corporation Approved for Public Release; Distribution Unlimited. Case Number 18-1174 / DHS reference number 16-J-00184-01 This document is a product of the Homeland Security Systems Engineering and Development Institute (HSSEDI™). Homeland Security Systems Engineering & Development Institute The Homeland Security Act of 2002 (Section 305 of PL 107-296, as codified in 6 U.S.C. 185), herein referred to as the “Act,” authorizes the Secretary of the Department of Homeland Security (DHS), acting through the Under Secretary for Science and Technology, to establish one or more federally funded research and development centers (FFRDCs) to provide independent analysis of homeland security issues. The MITRE Corporation operates the Homeland Security Systems Engineering and Development Institute (HSSEDI) as an FFRDC for DHS under contract HSHQDC-14-D-00006. The HSSEDI FFRDC provides the government with the necessary systems engineering and development expertise to conduct complex acquisition planning and development; concept exploration, experimentation and evaluation; information technology, communications and cyber security processes, standards, methodologies and protocols; systems architecture and integration; quality and performance review, best practices and performance measures and metrics; and, independent test and evaluation activities. The HSSEDI FFRDC also works with and supports other federal, state, local, tribal, public and private sector organizations that make up the homeland security enterprise. The HSSEDI FFRDC’s research is undertaken by mutual consent with DHS and is organized as a set of discrete tasks.
    [Show full text]
  • Attack Patterns As a Knowledge Resource for Building Secure Software Sean Barnum Amit Sethi Cigital, Inc
    Attack Patterns as a Knowledge Resource for Building Secure Software Sean Barnum Amit Sethi Cigital, Inc. Cigital, Inc. Building software with an adequate level of security assurance for its mission becomes more and more challenging every day as the size, complexity, and tempo of software creation increases and the number and the skill level of attackers continues to grow. These factors each exacerbate the issue that, to build secure software, builders must ensure that they have protected every relevant potential vulnerability; yet, to attack software, attackers often have to find and exploit only a single exposed vulnerability. To identify and mitigate relevant vulnerabilities in software, the development community needs more than just good software engineering and analytical practices, a solid grasp of software security features, and a powerful set of tools. All of these things are necessary but not sufficient. To be effective, the community needs to think outside of the box and to have a firm grasp of the attacker’s perspective and the approaches used to exploit software [Hoglund 04, Koizol 04]. This paper discusses the concept of attack patterns as a mechanism to capture and communicate the at- tacker’s perspective. Attack patterns are descriptions of common methods for exploiting software. They derive from the concept of design patterns [Gamma 95] applied in a destructive rather than constructive context and are generated from in-depth analysis of specific real-world exploit examples. Through analy- sis of observed exploits, the
    [Show full text]
  • Chapter 1- Web Application Security Fundamentals
    Chapter 1- Web Application Security Fundamentals Improving Web Application Security: Threats and Countermeasures J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan Microsoft Corporation Published: June 2003 See the "patterns & practices Security Guidance for Applications Index" for links to additional security resources. See the Landing Page for the starting point and a complete overview of Improving Web Application Security: Threats and Countermeasures. Summary: This chapter introduces Web application security, explains common security terminology and presents a set of proven security principles upon which many of the recommendations throughout this guide are based. It presents an overview of the security process and explains why a holistic approach to security that covers multiple layers including the network, host and application, is required to achieve the goal of hack-resilient Web applications. This chapter also introduces and defines host configuration categories and application vulnerability categories, which are used throughout the remainder of this guide. Contents We Are Secure -- We Have a Firewall What Do We Mean By Security? Threats, Vulnerabilities, and Attacks Defined How Do You Build a Secure Web Application? Secure Your Network, Host, and Application Securing Your Network Securing Your Host Securing Your Application Security Principles Summary Additional Resources When you hear talk about Web application security, there is a tendency to immediately think about attackers defacing Web sites, stealing credit card numbers, and bombarding Web sites with denial of service attacks. You might also think about viruses, Trojan horses, and worms. These are the types of problems that receive the most press because they represent some of the most significant threats faced by today's Web applications.
    [Show full text]
  • Attack Analysis Methodologies Attack Analysis Methodologies in the Automotive Industry
    Attack Analysis Methodologies Attack Analysis Methodologies in the Automotive Industry Master’s thesis in Computer Systems and Networks Seyed Reza Esmaeili & Afshin Soltani Esterabadi Department of Computer Science and Engineering CHALMERS UNIVERSITY OF TECHNOLOGY Gothenburg, Sweden 2019 Master’s thesis 2019 Attack Analysis Methodologies Attack Analysis Methodologies in the Automotive Industry Seyed Reza Esmaeili Afshin Soltani Esterabadi Department of Computer Science and Engineering Division of Computer Systems and Networks Chalmers University of Technology Gothenburg, Sweden 2019 Attack Analysis Methodologies Attack Analysis Methodologies in the Automotive Industry SEYED REZA ESMAEILI & AFSHIN SOLTANI ESTERABADI © SEYED REZA ESMAEILI, AFSHIN SOLTANI ESTERABADI, 2019. Supervisor: Erland Jonsson, Department of Computer Science and Engineering Advisors: Christian Sandberg & Manne Engelke, Volvo Group Trucks Technology Examiner: Tomas Olovsson, Department of Computer Science and Engineering Master’s Thesis 2019 Department of Computer Science and Engineering Division of Computer Systems and Networks Chalmers University of Technology SE-412 96 Gothenburg Telephone +46 31 772 1000 Cover: Volvo FH 4x2 truck. © Volvo Truck Corporation. All rights reserved. Typeset in LATEX Gothenburg, Sweden 2019 iv Attack Analysis Methodologies Attack Analysis Methodologies in the Automotive Industry SEYED REZA ESMAEILI & AFSHIN SOLTANI ESTERABADI Department of Computer Science and Engineering Chalmers University of Technology Abstract In recent years, we have witnessed that technology has advanced dramatically. While new, hi-tech, automated devices entered our lives, a tendency of moving from the disjointed nature of objects to a more interconnected world has emerged. Although such need of interconnection was originated in the IT industry and with the Internet of Things (IoT), automotive industry was also affected by such a trend.
    [Show full text]
  • Classification of SQL Injection Attacks
    Classification of SQL Injection Attacks San-Tsai Sun, Ting Han Wei, Stephen Liu, Sheung Lau Electrical and Computer Engineering, University of British Columbia santsais,tinghanw,stephenl,sheungl @ece.ubc.ca { } Abstract—Most web applications deployed today are vulnera- hend model is needed. Previous efforts have focused on clas- ble to SQL injection attacks. The reason for this pervasiveness sifying web-based attacks in general, of which SQL injection is that web applications and detection systems do not know is classified as a special form of code injection attack [12]. the attacks thoroughly and use limited sets of attack patterns during evaluation. To address this problem, this paper presents a One classification that focuses primarily on SQL injection semantic-aware, easy to comprehend SQL injection attack model attacks has been conducted by Halfond, Viegas, and Orso [1]. and classification scheme. The proposed classification covers In that paper, the attacks are classified according to injection aspects of SQL injection attacks that are not included in existing mechanism, attack intent, and the attack type. However, many classification schemes. To evaluate the classification scheme, we aspects of SQL injection attacks, such as evasion techniques, build an attack repository by collecting SQL injection attacks from various internet sources. This classification and repository result retrieval techniques, assets, threats, vulnerabilities, the can be used to help developers and administrators understand DBMS in question, and countermeasures, are not included. better SQL injection attacks and evaluate defending mechanism Moreover, semantic relations between the categories are not more thoroughly. established, making the classification difficult to comprehend in a broad perspective.
    [Show full text]
  • Threat Modeling
    www.it-ebooks.info www.it-ebooks.info fl ast.indd 11:57:23:AM 01/17/2014 Page xx Threat Modeling Designing for Security Adam Shostack www.it-ebooks.info ffi rs.indd 12:57:18:PM 01/17/2014 Page i Threat Modeling: Designing for Security Published by John Wiley & Sons, Inc. 10475 Crosspoint BoulevardIndianapolis, IN 46256 www.wiley.com Copyright © 2014 by Adam Shostack Published by John Wiley & Sons, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-1-118-80999-0 ISBN: 978-1-118-82269-2 (ebk) ISBN: 978-1-118-81005-7 (ebk) Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permis- sion of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley .com/go/permissions. Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifi cally disclaim all warranties, including without limitation warranties of fi tness for a particular purpose.
    [Show full text]