Deck 10: Buffer Overflow

Question 1

An attacker is more interested in transferring control to a location and
code of the attacker's choosing rather than immediately crashing the
program.

Answer 1

True

Question 2

The potential for a buffer overflow exists anywhere that data is copied
or merged into a buffer,where at least some of the data are read from
outside the program.

Answer 2

True

Question 3

Buffer overflow exploits are no longer a major source of concern to
security practitioners.

Answer 3

False

Question 4

Shellcode is not specific to a particular processor architecture.

Question 5

Stack buffer overflow attacks were first seen in the Aleph One Worm.

Question 6

A buffer _________ is a condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated,overwriting other information.

A)overflow
B)overrun
C)overwrite
D)all of the above

Question 7

Shellcode must be able to run no matter where in memory it is
located.

Question 8

An attacker can generally determine in advance exactly where the
targeted buffer will be located in the stack frame of the function in
which it is defined.

Question 9

A stack buffer overflow is also referred to as ___________ .

A)stack framing
B)stack smashing
C)stack shocking
D)stack running

Question 10

The function of ________ was to transfer control to a user command-line interpreter,which gave access to any program available on the system with the privileges of the attacked program.

A)shellcode
B)stacking
C)no-execute
D)memory management

Question 11

At the basic machine level,all of the data manipulated by machine
instructions executed by the computer processor are stored in either the processor's registers or in memory.

Question 12

To exploit any type of buffer overflow the attacker needs to identify a
buffer overflow vulnerability in some program that can be triggered
using externally sourced data under the attackers control.

Question 13

Buffer overflows can be found in a wide variety of programs,
processing a range of different input,and with a variety of possible
responses.

Question 14

A consequence of a buffer overflow error is __________ .

A)corruption of data used by the program
B)unexpected transfer of control in the program
C)possible memory access violation
D)all of the above

Question 15

The buffer overflow type of attack has been known since it was first widely used by the __________ Worm in 1988.

A)Code Red
B)Slammer
C)Morris Internet
D)Alpha One

Question 16

Even though it is a high-level programming language,Java still suffers
from buffer overflows because it permits more data to be saved into a buffer than it has space for.

Question 17

Buffer overflow attacks are one of the most common attacks seen.

Question 18

A buffer overflow error is not likely to lead to eventual program
termination.

Question 19

A stack overflow can result in some form of a denial-of-service attack
on a system.

Question 20

There are several generic restrictions on the content of shellcode.

Question 21

Traditionally the function of __________ was to transfer control to a user command-line interpreter,which gave access to any program available on the system with the privileges of the attacked program.

A)shellcode
B)C coding
C)assembly language
D)all of the above

Question 22

Data is simply an array of _________ .

Question 23

__________ defenses aim to harden programs to resist attacks in new programs.

Question 24

A ___________ overflow occurs when the targeted buffer is located on the stack,usually as a local variable in a function's stack frame.

Question 25

_________ is a tool used to automatically identify potentially vulnerable programs.

A)Slamming
B)Sledding
C)Fuzzing
D)All of the above

Question 26

A buffer overflow in Microoft Windows 2000/XP Local Security Authority Subsystem Service was exploited by the _________ .

A)Aleph One
B)Sasser worm
C)Slammer worm
D)none of the above

Question 27

A __________ can occur as a result of a programming error when a process attempts to store data beyond the limits of a fixed-size buffer and consequently overwrites adjacent memory locations.

Question 28

Shellcode has to be __________,which means it cannot contain any absolute address referring to itself.

Question 29

__________ defenses aim to detect and abort attacks in existing programs.

Question 30

A _________ value is named after the miner's bird used to detect poisonous air in a mine and warn miners in time for them to escape.

Question 31

"Smashing the Stack for Fun and Profit" was a step by step introduction to exploiting stack-based buffer overflow vulnerabilities that was published in Phrack magazine by _________ .

Question 32

The __________ used a buffer overflow exploit in "fingerd" as one of its attack mechanisms.

A)Code Red Worm
B)Sasser Worm
C)Morris Internet Worm
D)Slammer Worm

Question 33

An essential component of many buffer overflow attacks is the transfer of execution to code supplied by the attacker and often saved in the buffer being overflowed.This code is known as _________ .

Question 34

The Packet Storm Web site includes a large collection of packaged shellcode,including code that can:

A)create a reverse shell that connects back to the hacker
B)flush firewall rules that currently block other attacks
C)set up a listening service to launch a remote shell when connected to
D)all of the above

Question 35

The __________ project produces a free,multiplatform 4.4BSD-based UNIX-like operating system.

Question 36

In 2003 the _________ exploited a buffer overflow in Microsoft SQL Server 2000.

A)Slammer worm
B)Morris Internet Worm
C)Sasser worm
D)Code Red worm

Question 37

The buffer is located __________ .

A)in the heap
B)on the stack
C)in the data section of the process
D)all of the above

Question 38

_________ is a form of overflow attack.

A)Heap overflows
B)Return to system call
C)Replacement stack frame
D)All of the above

Question 39

__________ aim to prevent or detect buffer overflows by instrumenting programs when they are compiled.

A)Compile-time defenses
B)Shellcodes
C)Run-time defenses
D)All of the above

Question 40

__________ is one of the best known protection mechanisms that is a GCC compiler extension that inserts additional function entry and exit code.

Question 41

_________ attacks can occur in a binary buffer copy when the programmer has included code to check the number of bytes being transferred,but due to a coding error,allows just one more byte to be copied than there is space available.

Question 42

The _________ is typically located above the program code and global data and grows up in memory (while the sack grows down toward it).

Question 43

In the classic __________ overflow,the attacker overwrites a buffer located in the local variable area of a stack frame and then overwrites the saved frame pointer and return address.

Question 44

Gaps,or __________ ,are flagged in the MMU as illegal addresses,and any attempt to access them results in the process being aborted.