A company wants to confirm sufficient executable space protection is in place for scenarios in which malware may be attempting buffer overflow attacks. Which of the following should the security…

The correct answer is B. ASLR. Address space layout randomization (ASLR) is a technique designed to protect against buffer overflow attacks, initially implemented in 2003. Presently, all major operating systems-server, desktop, and mobile-incorporate ASLR. How does ASLR work? In a buffer overflow attack, an…

Technical Integration of Enterprise Security

Question

A company wants to confirm sufficient executable space protection is in place for scenarios in which malware may be attempting buffer overflow attacks. Which of the following should the security engineer check?

Options

ANX/XN
BASLR
Cstrcpy
DECC

How the community answered

(55 responses)

A
4% (2)
B
93% (51)
C
2% (1)
D
2% (1)

Explanation

Address space layout randomization (ASLR) is a technique designed to protect against buffer overflow attacks, initially implemented in 2003. Presently, all major operating systems-server, desktop, and mobile-incorporate ASLR. How does ASLR work? In a buffer overflow attack, an attacker needs to know the location in the code where a given function accepts input. The attacker will feed just the right amount of garbage to that code location, including a malicious payload. Ideally, the attacker also includes an instruction to go to another point in the code and the malicious payload and instruction will run with the privileges of the application.

Topics

#buffer overflow protection#NX bit#ASLR#memory security

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice