9 (iSpts) Answer the following: (a) Explain what a bufer overflow attack is. [7

Question

9 (iSpts) Answer the following: (a) Explain what a bufer overflow attack is. [7 points) The following code sets user pouswords on a machine. Examine the code. If this code is vulnerable to buffer overflow attacks, state the vulnerability with possible attack scenario. Also, if this cod de is vulnerable to the overflow attack, show how you will remove this vulnerability. B points] char nare [20] char password [8] struct user List{ int num Users bool settlaerPassword (char .userNane, char userPassword. struct user nevUser stropy (be User.nane strcpy (ne User password userPaasword) if (list- nun0fUsers 1 >a MAI NUM USERS) print ("USER LIST IS FULLVn") return (false) upda te uaer list list nunofUsers 1 list users [list- nurofUsers] nevlaer

Explanation / Answer

Buffer Overflow Attack:

A Buffer Overflow Attack is an attack that abuses a type of bug called a “buffer overflow”, in which a program overwrites memory adjacent to a buffer that should not have been modified intentionally or unintentionally. Buffer overflows are commonly associated with C-based languages, which do not perform any kind of array bounds checking.

As a result, operations such as copying a string from one buffer to another can result in the memory adjacent to the new (shorter) buffer to be overwritten with excess data.

When a buffer overflow occurs in a program, it will often crash or become unstable. An attacker attempting to abuse a buffer overflow for a more specific purpose other than crashing the target system, can purposely overwrite important values in the call stack of the target machine such as the instruction pointer (IP) or base pointer (BP) in order to execute his or her potentially malicious unsigned code.

Operating system and software vendors often employ countermeasures in their products to prevent Buffer Overflow Attacks; particularly call stack and virtual memory randomization.

(b.) in the following code line i.e. strcpy(newUser.name,userName) and strcpy(newUser.password,userPassword). The call to strcpy is the one that is dangerous. strcpy will just copy character for character until it finds a "0" character in the source string.

Since the argument we give to the call can be much longer, this can mess up the stack.

When the stack is messed up, the return address from setUserPassword will be overwritten. With other words, instead of going back to the next instruction after setUserPassword in main, the next instruction executed after setUserPassword finishes will be whatever is in the stack location.

Related Questions

Navigate

• Browse (All)
• Browse 9
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.