Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

A security analyst is investigating a service disruption on a C-based legacy network daemon. Examination of the stack memory dump reveals that an incoming request sent a payload exceeding the allocated array bounds, overwriting the adjacent memory locations and altering the function return address to execute injected instructions. Which of the following application vulnerabilities is demonstrated in this scenario?

  1. Buffer overflowAnswer
  2. B
    Cross-site scripting (XSS)
  3. C
    Insecure direct object reference (IDOR)
  4. D
    Missing network boundary firewall rules

Answer

The application suffers from a buffer overflow vulnerability.
The correct option correctly identifies a buffer overflow. When an application receives more input than its memory buffer is designed to hold without proper bounds checking, the extra data overflows into adjacent memory. In stack-based buffer overflows, this can overwrite execution control pointers such as the return address.

Step-by-Step Solution

1
Analyze the incident details provided in the crash memory dump.
Identified that input data exceeded the allocated buffer size.
Understanding where and how memory boundaries were violated establishes the attack vector.
2
Evaluate the effect of the memory overwrite.
Adjacent stack memory and the return address were overwritten to alter program execution flow.
Modifying return execution pointers via unvalidated memory writes is a classic indicator of a stack-based buffer overflow.
3
Map the observed behavior to software vulnerability taxonomy.
Confirmed the vulnerability is a buffer overflow.
Buffer overflow directly describes the condition where fixed-size memory boundaries are breached due to missing bounds checking.

Key Concept

Buffer Overflow
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic