@Startzc wrote:
Came across this question on a practice test that someone else recommended, and was curious of your opinion on the answer and explanation it gives:
Why do buffers overflow?
(a) Because buffers can only hold so much data.
(b) Because input data is not checked for appropriate length at time of input.
(c) Because they are an easy weakness to exploit.
(d) Because of insufficient system memory.
Answer: (d) Buffer overflows are the most common type of DoS attack. Here, an attacker sends more data than the application's buffer can hold. When the amount of data exceeds the buffer size, the extra data overflows under the stack, often causing the application or the whole system to crash. In some cases, the data can be carefully crafted to include machine code that will execute when it overflows onto the stack.
########################
While agree with it technically, if the data processed is validated correctly and size limits are enforced, the amount of memory shouldn't be the cause (or the Why?). Thoughts?
So if we can define a buffer and buffer overflow as:
Buffers are areas of memory set aside to hold data, often while moving it from one section of a program to another, or between programs. Buffer overflows can often be triggered by malformed inputs; if one assumes all inputs will be smaller than a certain size and the buffer is created to be that size, then an anomalous transaction that produces more data could cause it to write past the end of the buffer. If this overwrites adjacent data or executable code, this may result in erratic program behavior, including memory access errors, incorrect results, and crashes.
Then D is incorrect because it is not the cause of the buffer overflow. It might be A cause, but not always THE cause. If we are just looking for a cause then A (per the answer provided and highlighted in bold above) and B are correct also.
C would be incorrect because it is not why a buffer overflows, just a possible attack vector. Even if it is a very popular attack vector it is not why a buffer overflows.
B is correct but it is not why the buffer overflows. Yes checking input length can prevent buffer overflows, but it is not why the buffer overflowed. Chicken and egg theory.
A is the most correct answer to me, even if poorly worded. The correct statement would be because buffers can only hold the amount of data they are allocated to hold.
So technically buffers overflow because more data is input than was allocated for, and answer a is the only answer that is 100% true. Answer B is a preventative measure and can eliminate A but per definition, A is still more correct. C is incorrect and D might cause an overflow but is not the cause of 100% of an overflow.
I agree with others that it is a horrible question.
