During a security assessment of a legacy network daemon written in C, security engineers identify that user-supplied input is copied directly into a fixed-size stack buffer using the `strcpy()` function without length checking. A junior developer proposes deploying a Web Application Firewall (WAF) to filter incoming traffic as the primary remediation. Which statement best evaluates the proposed solution and identifies the most effective remediation?
- Deploying a network-level control such as a WAF does not resolve the underlying flaw in the application code; the source code must be modified to implement bounds checking or safe string functions.Cevap
- BThe WAF deployment is the ideal solution because perimeter controls eliminate the need to refactor source code when addressing memory corruption vulnerabilities.
- CThe proposed WAF is ineffective because stack buffer overflows represent database manipulation attacks that require parameterized database queries rather than packet inspection.
- DDeploying a WAF fails to resolve the issue because memory write operations require robust role-based access control and authorization policies rather than input length validation.
Cevap
Network-level controls like a WAF do not eliminate software defects; source code modification to enforce bounds checking or safe functions is required.
The correct answer emphasizes that network-level filtering like a WAF is merely a temporary or compensating filter. Complete remediation of a buffer overflow requires securing the application code directly using memory-safe functions or explicit input length checking before copying data to fixed memory buffers.
Adım Adım Çözüm
Anahtar Kavram
Remediating application memory vulnerabilities requires code-level fixes (secure coding standards/bounds checking) rather than sole reliance on external network controls.