SY0-501 Question #485: Real Exam Question with Answer & Explanation

Question

An analyst is reviewing a simple program for potential security vulnerabilities before being deployed to a Windows server. Given the following code: void foo (char *bar) { car random_user_input[12]; stropy (random_user_input, bar); } Which of the following vulnerabilities is present?

Options

• ABad memory pointer
• BBuffer overflow
• CInteger overflow
• DBackdoor

Explanation

The code copies an unchecked user-supplied string into a fixed 12-byte buffer using strcpy, which does not perform bounds checking and can overwrite adjacent memory.

Common mistakes.

• A. A bad memory pointer vulnerability involves dereferencing null, uninitialized, or dangling pointers; the code here uses a valid stack-allocated array, so pointer misuse is not the primary issue.
• C. An integer overflow occurs when arithmetic on integer values exceeds the type's maximum range, causing unexpected wraparound; no integer arithmetic is performed in this code.
• D. A backdoor is an intentional hidden mechanism for unauthorized access deliberately inserted into code; this vulnerability is an unintentional coding error, not a hidden access mechanism.

Concept tested. Stack-based buffer overflow via unchecked strcpy usage

Reference. https://learn.microsoft.com/en-us/windows/win32/secbp/avoiding-buffer-overruns

No community discussion yet for this question.