CAS-003 · Question #799
A security analyst is reading the results of a successful exploit that was recently conducted by third-party penetration testers. The testers reverse engineered a privileged executable. In the…
The correct answer is A. A TOC/TOU vulnerability. A TOC/TOU (Time of Check/Time of Use) race condition in a privileged executable allows an attacker who has reverse engineered the binary to insert a malicious action in the window between a security check and the use of the checked resource.
Question
A security analyst is reading the results of a successful exploit that was recently conducted by third-party penetration testers. The testers reverse engineered a privileged executable. In the report, the planning and execution of the exploit is detailed using logs and outputs from the test However, the attack vector of the exploit is missing, making it harder to recommend remediation's. Given the following output:
The penetration testers MOST likely took advantage of:
Exhibit
Options
- AA TOC/TOU vulnerability
- BA plain-text password disclosure
- CAn integer overflow vulnerability
- DA buffer overflow vulnerability
How the community answered
(27 responses)- A63% (17)
- B11% (3)
- C22% (6)
- D4% (1)
Why each option
A TOC/TOU (Time of Check/Time of Use) race condition in a privileged executable allows an attacker who has reverse engineered the binary to insert a malicious action in the window between a security check and the use of the checked resource.
A TOC/TOU vulnerability is a race condition where system state changes between when a privilege or resource check is performed and when the resource is actually used. By reverse engineering the privileged executable, penetration testers can identify that timing window and manipulate the environment during it to escalate privileges or access protected resources. This type of exploit leaves minimal obvious indicators in logs, which explains why the attack vector was absent from the report.
Plain-text password disclosure would appear directly in memory dumps or traffic captures and would not require reverse engineering a privileged binary to discover.
An integer overflow targets arithmetic boundary conditions in data processing routines and would produce different log artifacts than a race condition exploit.
A buffer overflow causes memory corruption that produces characteristic crash signatures or shellcode patterns in output, which would be evident in the testers' logs and not absent from the report.
Concept tested: TOC/TOU race condition in privileged executables
Source: https://owasp.org/www-community/vulnerabilities/Time_of_check_time_of_use
Topics
Community Discussion
No community discussion yet for this question.