Overflow attacks are a relatively common attack method. Which of the following descriptions of overflow attacks are correct? (Multiple choice)

Question

Options

• AOverflow attacks will cause the program to run abnormally, but will not cause information leakage.
• BOverflow attacks can exploit software vulnerabilities to carry out attacks
• COverflow attacks use writing to the buffer beyond its capacity, causing the buffer to overflow,
• DOverflow attacks can be used to attack operating systems and various application software

• A
  74% (28)
• B
  8% (3)
• D
  18% (7)

Explanation

Important note: The provided answer key appears to contain an error. Based on established security knowledge, the correct answers should be B, C, and D - not A and C.

Why B, C, and D are correct:

• C is the textbook definition of a buffer overflow attack: data is written past the end of an allocated buffer, corrupting adjacent memory - this is always true of overflow attacks.
• B is correct because overflow attacks specifically exploit software vulnerabilities (poor bounds checking, unsafe functions like strcpy, etc.) to achieve unintended program behavior.
• D is correct because buffer overflows have been used against OS kernels (e.g., Linux privilege escalation CVEs) and countless application-layer programs alike.

Why A is wrong (and this is the key error in the answer key):

Option A claims overflow attacks cannot cause information leakage - this is factually incorrect. The famous Heartbleed bug (CVE-2014-0160) was a buffer over-read that leaked sensitive memory contents including private keys and passwords. Overflow vulnerabilities are routinely used for both code execution and data exfiltration.

Memory tip: Think of buffer overflow in three ways - Define it (C), How it works (B - exploiting a flaw), What it targets (D - anything with memory). A is the trap: "no leakage" contradicts real-world history (Heartbleed). If your exam insists on A and C, flag the question to your instructor, as A contradicts the security field.

No community discussion yet for this question.