Examkin

Soru

Zorluk: OrtaApplication and Software Vulnerabilities

A software security engineer is reviewing static code analysis findings for a legacy file rendering service. The report identifies two vulnerabilities: one where unvalidated user input is directly concatenated into a shell command string, allowing arbitrary system execution, and another where arithmetic calculations for buffer allocation fail to validate integer limits, leading to potential heap buffer overflows. Which of the following remediation techniques should the team implement to directly fix these code-level software vulnerabilities? (Select TWO).

  1. Replace direct shell command execution calls with parameterized API functions and strict input allowlists.Cevap
  2. Implement explicit integer bounds checking and range validation before dynamic memory allocation calls.Cevap
  3. C
    Deploy network-level perimeter firewalls to filter incoming SQL syntax keywords from web requests.
  4. D
    Migrate service authentication from HTTP Basic auth headers to OAuth 2.0 bearer token validation.

Cevap

The team should replace direct shell execution calls with parameterized API functions (and strict allowlisting) to address command injection, and implement explicit integer bounds checking prior to dynamic memory allocation to prevent heap buffer overflows.
Replacing shell calls with parameterized execution prevents malicious input from breaking out of data context into executable commands. Additionally, checking integer upper limits before allocating dynamic memory prevents integer overflow wrap-arounds from yielding undersized buffers.

Adım Adım Çözüm

1
Analyze the first vulnerability (OS Command Injection).
Identify that directly passing user input to system shell execution permits arbitrary command execution.
Eliminating shell invocation through safe parameterized interfaces or strict input validation remediates command injection.
2
Analyze the second vulnerability (Integer Overflow leading to Buffer Overflow).
Identify that unverified integer arithmetic can wrap around, causing undersized memory allocation.
Performing explicit bounds checks before memory allocation prevents integer overflow from triggering heap corruption.
3
Evaluate remediation options for appropriateness.
Select parameterized execution and explicit bounds checking as code-level fixes, while discarding network-level and authentication-focused controls.
Software vulnerabilities must be addressed with relevant code security controls rather than unrelated identity or network mechanisms.

Anahtar Kavram

Remediating Application Code Vulnerabilities (Command Injection & Memory Management Flaws)
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru