CAS-005 · Question #449
A security architect examines a section of code and discovers the following: char username[20] char password[20] gets(username) checkUserExists(username) Which of the following changes should the secu
The correct answer is C. Prevent more than 20 characters from being entered.. The use of gets() allows an attacker to overflow the 20-byte username buffer by entering more data than it can hold. Enforcing a 20-character limit (for example, by switching to fgets(username, sizeof(username), stdin)) prevents buffer overruns and eliminates this class of vulner
Question
A security architect examines a section of code and discovers the following:
char username[20] char password[20] gets(username) checkUserExists(username) Which of the following changes should the security architect require before approving the code for release?
Options
- AAllow only alphanumeric characters for the username.
- BMake the password variable longer to support more secure passwords.
- CPrevent more than 20 characters from being entered.
- DAdd a password parameter to the function.
How the community answered
(19 responses)- A11% (2)
- B5% (1)
- C79% (15)
- D5% (1)
Explanation
The use of gets() allows an attacker to overflow the 20-byte username buffer by entering more data than it can hold. Enforcing a 20-character limit (for example, by switching to fgets(username, sizeof(username), stdin)) prevents buffer overruns and eliminates this class of vulnerability.
Community Discussion
No community discussion yet for this question.