CAS-002 · Question #832
A security manager looked at various logs while investigating a recent security breach in the data center from an external source. Each log below was collected from various security devices compiled…
The correct answer is B. Log 2 E. Buffer overflow. Log 2, consisting of repeated 'a' characters, is the classic signature of a buffer overflow attack attempt aimed at overwriting adjacent memory to hijack execution flow.
Question
A security manager looked at various logs while investigating a recent security breach in the data center from an external source. Each log below was collected from various security devices compiled from a report through the company's security information and event management server. Logs:
Log 1:
Feb 5 23:55:37.743: %SEC-6-IPACCESSLOGS: list 10 denied 10.2.5.81 3 packets Log 2:
aaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Log 3:
Security Error Alert Event ID 50: The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client Log 4:
Encoder oe = new OracleEncoder (); String query = "Select user_id FROM user_data WHERE user_name = " + oe.encode ( req.getParameter("userID") ) + " and user_password = " + oe.encode ( req.getParameter("pwd") ) +" "; Vulnerabilities Buffer overflow SQL injection ACL XSS Which of the following logs and vulnerabilities would MOST likely be related to the security breach? (Select TWO).
Options
- ALog 1
- BLog 2
- CLog 3
- DLog 4
- EBuffer overflow
- FACL
- GXSS
- HSQL injection
How the community answered
(39 responses)- A8% (3)
- B69% (27)
- D15% (6)
- F5% (2)
- G3% (1)
Why each option
Log 2, consisting of repeated 'a' characters, is the classic signature of a buffer overflow attack attempt aimed at overwriting adjacent memory to hijack execution flow.
Log 1 is a Cisco ACL log showing packets denied from an IP address - it indicates a firewall or access control list block event, not the breach itself.
Log 2 contains a long string of repeated 'a' characters, which is the canonical pattern used in buffer overflow exploits to flood a memory buffer and overwrite adjacent memory structures such as return addresses or function pointers.
Log 3 is an RDP X.224 component error showing a client disconnection due to a protocol stream error, which may indicate an RDP scanning or fuzzing attempt but not a buffer overflow attack.
Log 4 shows application-level input encoding using OracleEncoder to sanitize SQL parameters, which is a defense against SQL injection rather than evidence of an attack.
The repeated character padding in Log 2 identifies a buffer overflow attack - an attacker submits input far exceeding the expected buffer size in order to corrupt memory and potentially redirect execution to attacker-controlled code.
ACL corresponds to Log 1, which shows denied traffic from a firewall rule - this is a preventive control activity and not the attack type responsible for the breach.
XSS involves injecting malicious scripts into web content returned to browsers; none of the logs contain HTML or JavaScript injection patterns indicative of an XSS attempt.
SQL injection would appear as malformed SQL syntax in input parameters; Log 4 shows proper parameterized encoding being applied as a defense, not an active injection attack.
Concept tested: Identifying buffer overflow attack signatures in security logs
Source: https://owasp.org/www-community/vulnerabilities/Buffer_Overflow
Topics
Community Discussion
No community discussion yet for this question.