Software Security Week 2 Quiz Answer
In this article i am gone to share Coursera Course Software Security Week 2 Quiz Answer with you..
Week 2 Quiz Answer
Question 1)
A program indexes a buffer after a pointer to that buffer has been used as a parameter to the free() function.
- This is Correct behavior
- An information flow violation
- A violation of temporal memory safety
- A violation of spatial memory safety
ย
Question 2)
When could an integer overflow impact memory safety?
- If the integer was passed as a parameter to open()
- If the integer was passed as a parameter to printf()
- If the integer was used to perform pointer arithmetic
- If the integer is passed as an argument to malloc()
- If the integer is used as the denominator in a division expression
ย
Question 3)
Which of the following are true about a language that uses garbage collection or some other automatic means (e.g., reference counting) for memory management? (Select all that apply.)
- The language will not have type safety violations
- The language will not have spatial memory safety violations
- The use of automatic memory management will provide a safety benefit, but typically at the cost of some performance
ย
Question 4)
Consider the following code:
ย
char *foo(char *buf) {
ย char *x = buf+strlen(buf);
ย char *y = buf;
ย while (y != x) {
ย ย if (*y == ‘a’)break;
ย ย y++;
ย }
ย return y;
}
void bar() {
ย char input[10] = “leonard”;
ย foo(input);
}
ย
The definition of spatial safety models pointers as capabilities, which are triples (p,b,e) where p is the pointer, b is the base of the memory region the pointer is allowed to access, and e is the extent of that region. Assuming characters are 1 byte in size, what is a triple (p,b,e) for the variable y when it is returned at the end of the code?
- (y,&input,buf)
- (&input+4,&input,&input+7)
- (&input+4,&input,&input+10)
- (&input+4,0,sizeof(input))
ย
Question 5)
Which of the following are true about a type-safe language? (Select all that apply.)
- The language is object-oriented.
- The language is also memory safe
- The language is sometimes memory safe, but not always
- The language is always much slower than a non-type safe language
ย
Question 6)
An engineer proposes that in addition to making the stack non-executable, your system should also make the heap non-executable.
- Doing so would Ensure that memory is always deallocated
- Not make the program more secure, because attacker-controlled data cannot be stored in the heap
- Make the program more secure by disallowing another location for an attacker to place executable code
- Ensure that only the correct amount of data was written to a heap-allocated block, preventing heap overflows
ย
Question 7)
What is the best choice of value for a stack canary, of the following options?
- The constant 0
- The constant 7
- A random value
- A predictable value
ย
Question 8)
A return-to-libc attack does not require that the attacker inject executable code into the vulnerable program. Which of the following is the most important reason that return-to-libc attacks are useful to the attacker?
- The injected code might have bugs
- There is no need to be able to execute (writable) data
- The code in libc is better than code the attacker would write
- There is no need to modify the application’s executable code
Question 9)
In a return-oriented program (ROP), what is the role of the stack pointer?
- It’s like the frame pointer in a normal program
- It’s really no different than in a normal program
- It’s like the allocation pointer used by malloc()
- It’s like the program counter in a normal program
ย
Question 10)
When enforcing Control Flow Integrity (CFI), there is no need to check that direct calls adhere to the control flow graph because:
- Programs that use CFI don’t have direct calls
- The attacker is not interested in corrupting direct calls
- CFI should be deployed on systems that ensure the code is immutable
- CFI should be deployed on systems that ensure the data is non-executable
ย
Question 11)
Recall that classic enforcement of CFI requires adding labels prior to branch targets, and adding code prior to the branch that checks the label to see if it’s the one that is expected. Now consider the following program:
ย
int cmp1(char *a, char *b) {
ย return strcmp(a,b);
}
int cmp2(char *a, char *b) {
ย return strcmp(b,a);
}
typedef int (*cmpp)(char*,char*);
int bar(char *buf) {
ย cmpp p;
ย char tmpbuff[512] = { 0 };
ย int l;
ย if(buf[0] == ‘a’) {
ย ย p = cmp1;
ย } else {
ย ย p = cmp2;
ย }
ย printf(“%pn”, p);
ย strcpy(tmpbuff, buf);
ย for(l = 0; l < sizeof(tmpbuff); l++) {
ย ย if(tmpbuff[l] == 0) {
ย ย ย break;
ย ย } else {
ย ย ย if(tmpbuff[l] > 97) {
ย ย ย ย tmpbuff[l] -= 32;
ย ย ย }
ย ย }
ย }
ย return p(tmpbuff,buf);
}
ย
To ensure that the instrumented program runs correctly when not being attacked, which of the following functions would have to be given the same label? Choose at least two, but no more functions than necessary.
- strcpy
- cmp1
- cmp2
- cmpp
- strcmp
Question 12)
In your review of a program, you discover the following function:
ย
void aFunction(char *buf) {
ย static char BANNED_CHARACTERS[] = { ‘>’, ‘<‘, ‘!’, ‘*’ };
ย int l = strlen(buf);
ย int i;
ย for(i = 0; i < l; i++) {
ย ย int j;
ย ย int k = sizeof(BANNED_CHARACTERS) / sizeof(char);
ย ย for(j = 0; j < k; j++) {
ย ย ย if(buf[i] == BANNED_CHARACTERS[j])
ย ย ย ย buf[i] = ‘ ‘;
ย ย }
ย }
}
ย
How would you best describe what this function is doing?
- Spatial safety enforcement
- Using a safe string library
- Input validation by whitelisting
- Input sanitization by blacklisting
ย
Question 13)
A safe string library typically attempts to ensure which of the following?
- That the strings have been properly sanitized
- That wide (i.e., multibyte) character strings can be used where single-byte character strings are expected.
- That strings from the safe library can be freely passed to the standard string library functions, and vice versa
- That there is sufficient space in a source and/or target string to perform operations like concatenation, copying, etc.
ย
Question 14)
A project manager proposes a C coding standard where pointer variables must be assigned to NULL after being passed to free(). Doing so:ย
- Helps code readability, but not security
- Prevents memory leaks, thus avoiding potential denial of service
- Is a poor security decision, because NULL pointer dereferences could cause the program to crash
- Stops writes to stale pointer values that might otherwise succeed and result in program compromise
Question 15)
A colleague proposes using a heap allocator that randomizes the addresses of allocated objects. This:
- Will have no impact on security or performance
- Will increase performance by keeping the cache sparsely populated
- Will make the program more secure, because attackers frequently rely on predicting the locations of heap-allocated objects in exploits
- Will make the program less secure, because the application will not be able to predict the locations of heap-allocated objects