Deck 10: Buffer Overflow

Question 1

To exploit any type of buffer overflow the attacker needs to identify abuffer overflow vulnerability in some program that can be triggeredusing externally sourced data under the attackers control.

Answer 1

True

Question 2

A buffer overflow error is not likely to lead to eventual programtermination.

Answer 2

False

Question 3

There are several generic restrictions on the content of shellcode.

Answer 3

True

Question 4

At the basic machine level, all of the data manipulated by machineinstructions executed by the computer processor are stored in either the processor's registers or in memory.

Question 5

Shellcode must be able to run no matter where in memory it islocated.

Question 6

Buffer overflows can be found in a wide variety of programs,processing a range of different input, and with a variety of possibleresponses.

Question 7

Buffer overflow attacks are one of the most common attacks seen.

Question 8

The potential for a buffer overflow exists anywhere that data is copiedor merged into a buffer, where at least some of the data are read fromoutside the program.

Question 9

The function of ________ was to transfer control to a user command-line interpreter, which gave access to any program available on the system with the privileges of the attacked program.

A) shellcode
B) stacking
C) no-execute
D) memory management

Question 10

An attacker can generally determine in advance exactly where thetargeted buffer will be located in the stack frame of the function inwhich it is defined.

Question 11

Even though it is a high-level programming language, Java still suffersfrom buffer overflows because it permits more data to be saved into a buffer than it has space for.

Question 12

A consequence of a buffer overflow error is __________ .

A) corruption of data used by the program
B) unexpected transfer of control in the program
C) possible memory access violation
D) all the above

Question 13

Buffer overflow exploits are no longer a major source of concern tosecurity practitioners.

Question 14

A stack overflow can result in some form of a denial-of-service attackon a system.

Question 15

Shellcode is not specific to a particular processor architecture.

Question 16

A stack buffer overflow is also referred to as ___________ .

A) stack framing
B) stack smashing
C) stack shocking
D) stack running

Question 17

An attacker is more interested in transferring control to a location andcode of the attacker's choosing rather than immediately crashing theprogram.

Question 18

A buffer _________ is a condition at an interface under which more input can be placed into a buffer or data holding area than the capacity allocated, overwriting other information.

A) overflow
B) overrun
C) overwrite
D) all the above

Question 19

Stack buffer overflow attacks were first seen in the Aleph One Worm.

Question 20

The buffer overflow type of attack has been known since it was first widely used by the __________ Worm in 1988.

A) Code Red
B) Slammer
C) Morris Internet
D) Alpha One

Question 21

A ___________ overflow occurs when the targeted buffer is located on the stack, usually as a local variable in a function's stack frame.

Question 22

Data is simply an array of _________ .

Question 23

_________ is a form of overflow attack.

A) Heap overflows
B) Return to system call
C) Replacement stack frame
D) All the above

Question 24

_________ is a tool used to automatically identify potentially vulnerable programs.

A) Slamming
B) Sledding
C) Fuzzing
D) All the above

Question 25

In 2003 the _________ exploited a buffer overflow in Microsoft SQL Server 2000.

A) Slammer worm
B) Morris Internet Worm
C) Sasser worm
D) Code Red worm

Question 26

A __________ can occur as a result of a programming error when a process attempts to store data beyond the limits of a fixed-size buffer and consequently overwrites adjacent memory locations.

Question 27

__________ defenses aim to harden programs to resist attacks in new programs.

Question 28

The Packet Storm Web site includes a large collection of packaged shellcode, including code that can:

A) create a reverse shell that connects back to the hacker
B) flush firewall rules that currently block other attacks
C) set up a listening service to launch a remote shell when connected to
D) all the above

Question 29

"Smashing the Stack for Fun and Profit" was a step by step introduction to exploiting stack-based buffer overflow vulnerabilities that was published in Phrack magazine by _________ .

Question 30

__________ is one of the best known protection mechanisms that is a GCC compiler extension that inserts additional function entry and exit code.

Question 31

The buffer is located __________ .

A) in the heap
B) on the stack
C) in the data section of the process
D) all the above

Question 32

__________ aim to prevent or detect buffer overflows by instrumenting programs when they are compiled.

A) Compile-time defenses
B) Shellcodes
C) Run-time defenses
D) All the above

Question 33

__________ defenses aim to detect and abort attacks in existing programs.

Question 34

An essential component of many buffer overflow attacks is the transfer of execution to code supplied by the attacker and often saved in the buffer being overflowed. This code is known as _________ .

Question 35

Traditionally the function of __________ was to transfer control to a user command-line interpreter, which gave access to any program available on the system with the privileges of the attacked program.

A) shellcode
B) C coding
C) assembly language
D) all the above

Question 36

The __________ project produces a free, multiplatform 4.4BSD-based UNIX-like operating system.

Question 37

The __________ used a buffer overflow exploit in "fingerd" as one of its attackmechanisms.

A) Code Red Worm
B) Sasser Worm
C) Morris Internet Worm
D) Slammer Worm

Question 38

__________ can prevent buffer overflow attacks, typically of global data, whichattempt to overwrite adjacent regions in the processes address space, such as the global offset table.

A) MMUs
B) Guard pages
C) Heaps
D) All the above

Question 39

A buffer overflow in MicroSoft Windows 2000/XP Local Security Authority Subsystem Service was exploited by the _________ .

A) Aleph One
B) Sasser worm
C) Slammer worm
D) none of the above

Question 40

Shellcode has to be __________, which means it cannot contain any absolute address referring to itself.

Question 41

_________ attacks can occur in a binary buffer copy when the programmer has included code to check the number of bytes being transferred, but due to a coding error, allows just one more byte to be copied than there is space available.

Question 42

A _________ value is named after the miner's bird used to detect poisonous air in a mine and warn miners in time for them to escape.

Question 43

In the classic __________ overflow, the attacker overwrites a buffer located in the local variable area of a stack frame and then overwrites the saved frame pointer and return address.

Question 44

The _________ is typically located above the program code and global data and grows up in memory (while the sack grows down toward it).

Question 45

Gaps, or __________ , are flagged in the MMU as illegal addresses, and any attempt to access them results in the process being aborted.