Comp Security- Week 5a

Question 1

When does a format string vulnerability occur?

Answer 1

When a formatted I/O function expects more arguments than are provided

Question 2

%d output type and passed as?

Answer 2

decimal. passed as value

Question 3

%u output type and passed as?

Answer 3

unsigned decimal. passed as value

Question 4

%x output type and passed as?

Answer 4

hexadecimal. passed as value

Question 5

%s output type and passed as?

Answer 5

string. passed as reference

Question 6

%n output type and passed as?

Answer 6

number of bytes written so far, passed as reference

Question 7

Why is printf(buf) a sloppy use of printf function. And can a format string attack occur

Answer 7

sloppy use because format parameter is not written here.
No a format string attack cant occur because buf is not an input from the user however if they were to ask user to enter value of a variable and the correct format isnt followed a problem will occur

Question 8

Printf is a function so when its called what will be created?

Answer 8

a stack

Question 9

What is the first thing to be pushed in stack?

Answer 9

the arguments

Question 10

The first argument is always.. followed by…

Answer 10

The first argument is always the format string then followed by the specified arguments

Question 11

What happens if the programmer doesnt put the format string

Answer 11

Then printf will print even if we put variables and the attacker can benefit from this

Question 12

Format string attacks allow..

Answer 12

1. Read data from the stack from an illegal address causing program to crash (DOS)
2. Overwrite memory to change program execution or force execution of user supplied code
3. Access memory and extract confidential data

Question 13

What can an intruder do if he has control of the format string?

Answer 13

Read items in memory by using %x
Write items in memory by using %n (write to memory location after arg1)

Question 14

what happens if someone writes foobar%n

Answer 14

The num of characters in foobar=6 so that is the number of bytes that will be written to that location
The program will attempt to write the number 6 to the address
This will result in an error message and the memory wont be written and it will crash which will prove its exploitable

Question 15

when one could write to memory what are they able to do

Answer 15

With this ability they could overwrite a return pointer redirecting the execution path to the injected code

Question 16

Format string error prevention:

Answer 16

1. Validate input data, allow legal values only
2. Ensure user cant control format string parameters (use printf(“%s”,s) instead of printf(s)
3. Try to use constants for string formatting parameters
4. If available use snprintf instead of printf to convert numeric and string arguments to formatted strings