Correct Answer: B
Buffer Overflow attack takes advantage of improper parameter checking within the
application. This is the classic form of buffer overflow and occurs because the programmer
accepts whatever input the user supplies without checking to make sure that the length of the
input is less than the size of the buffer in the program.
The buffer overflow problem is one of the oldest and most common problems in software
development and programming, dating back to the introduction of interactive computing. It can
result when a program fills up the assigned buffer of memory with more data than its buffer can
hold. When the program begins to write beyond the end of the buffer, the program's execution
path can be changed, or data can be written into areas used by the operating system itself. This
can lead to the insertion of malicious code that can be used to gain administrative privileges on the
program or system.
As explained by Gaurab, it can become very complex. At the time of input even if you are checking
the length of the input, it has to be check against the buffer size. Consider a case where entry
point of data is stored in Buffer1 of Application1 and then you copy it to Buffer2 within Application2
later on, if you are just checking the length of data against Buffer1, it will not ensure that it will not
cause a buffer overflow in Buffer2 of Application2.
A bit of reassurance from the ISC2 book about level of Coding Knowledge needed for the exam:
It should be noted that the CISSP is not required to be an expert programmer or know the inner
workings of developing application software code, like the FORTRAN programming language, or
how to develop Web applet code using Java. It is not even necessary that the CISSP know
detailed security-specific coding practices such as the major divisions of buffer overflow exploits or
the reason for preferring str(n)cpy to strcpy in the C language (although all such knowledge is, of
course, helpful). Because the CISSP may be the person responsible for ensuring that security is
included in such developments, the CISSP should know the basic procedures and concepts
involved during the design and development of software programming. That is, in order for the
CISSP to monitor the software development process and verify that security is included, the
CISSP must understand the fundamental concepts of programming developments and the security
strengths and weaknesses of various application development processes.
The following are incorrect answers:
"Because buffers can only hold so much data" is incorrect. This is certainly true but is not the best
answer because the finite size of the buffer is not the problem -- the problem is that the
programmer did not check the size of the input before moving it into the buffer.
"Because they are an easy weakness to exploit" is incorrect. This answer is sometimes true but is
not the best answer because the root cause of the buffer overflow is that the programmer did not
check the size of the user input.
"Because of insufficient system memory" is incorrect. This is irrelevant to the occurrence of a
buffer overflow.
Reference(s) used for this question:
Hernandez CISSP, Steven (2012-12-21). Official (ISC)2 Guide to the CISSP CBK, Third Edition
((ISC)2 Press) (Kindle Locations 13319-13323). Auerbach Publications. Kindle Edition.
