GCIH: GIAC Certified Incident HandlerDemo

Question

John works as a C programmer and develops the following C program:

#include &lt;stdlib.h&gt;  
#include &lt;stdio.h&gt;  
#include &lt;string.h&gt;  
int buffer(char *str) \{  
char buffer1[10];  
strcpy(buffer1, str);  
return 1;  
\}  
int main(int argc, char *argv[]) \{  
buffer(argv[1]);  
printf("Executed\n");  
return 1;  
\}

His program is susceptible to a __________ attack.

A SQL injection
B Denial-of-Service
C Buffer overflow
D Cross site scripting

Explanation

strcpy performs no bounds checking. Copying an argument longer than the 10-byte buffer1 array can write beyond that array and overwrite adjacent memory, creating a buffer-overflow vulnerability.

GCIH: GIAC Certified Incident HandlerDemo

AstroTutor

Notes

Readiness

QuestionQ292

Community Discussion