Chapter 11

Question 1

Web app security flaws

Answer 1

1. unvalidated input
2. cross-site scripting
3. Buffer overflow
4. injection flaws
5. improper error handling

Question 2

reducing software vulnerabilities

Answer 2

1. stop vulnerabilities before occur
2. find vulnerabilities before exploited
3. reduce impact of vulnerabilities

Question 3

SAFECode

Answer 3

Software assurance forum for excellence in code

Question 4

canonicalization

Answer 4

transforming input data into single standard, minimal representation -> to compare to single representation of acceptable input

Question 5

Input fuzzing

Answer 5

randomly generate data as input to program

Question 6

writing safe program code

Answer 6

1. Correct algorithm implementation - no debugging code
2. Ensure machine code corresponds to algorithm - compiler might be hacked
3. Correct data interpretation - restrict + validate interpretation of data vars
4. Correct use of memory
5. race conditions - 2 threads try to access at same time - deadlock /corrupted values

Question 7

Environment vars

Answer 7

collection of string values inherited by each process from parent- can be modified by program process at any time

Question 8

Use of least privilege

Answer 8

1. privilege escalation - may give privileges to attacker
2. least privilege - run with least privilege needed

Question 9

Root/administrator privileges

Answer 9

programs with root privileges = target
- often privilege only needed at start
- partition into smaller modules

Question 10

preventing race conditions - lockfile

Answer 10

process must create + own lockfile to gain access - all programs must cooperate

Question 11

Safe temporary files

Answer 11

• temporary files in common shared system area
• must be unique

Question 12

handling program output

Answer 12

1. output stored ,sent , displayed
2. identify what is permissible output content + filter
3. defined character set