Question

A company wants to confirm sufficient executable space protection is in place for scenarios in which malware may be attempting buffer overflow attacks.

Which of the following should the security engineer check?

A. NX/XN
B. ASLR
C. strcpy
D. ECC

Answer 1

A security engineer should check the NX/XN and ASLR features to confirm sufficient executable space protection against buffer overflow attacks; NX/XN prevents code execution in data areas, and ASLR randomizes memory layout.

Step-by-step explanation:

To ensure that sufficient executable space protection is in place to prevent buffer overflow attacks, a security engineer should check for the following:

• NX/XN (Non-eXecutable / Execute Never) bits which, when used by a system, can mark certain areas of memory as non-executable. This prevents code from being run in areas of memory where data, such as the stack or heap, would typically reside, helping to mitigate the risk of buffer overflow attacks.
• ASLR (Address Space Layout Randomization) is a security feature that randomizes the memory address space positions where program executables and other system files are loaded. By doing so, it makes it more difficult for an attacker to predictably exploit memory corruption vulnerabilities like buffer overflows.
• strcpy is a function in C that copies strings and does not check boundaries, which can lead to buffer overflows; however, it is not a feature that protects against them. Security-conscious programming would avoid or replace such functions with safer alternatives.
• ECC (Error Correcting Code) memory is designed to detect and correct internal data corruption, not to prevent buffer overflow attacks.

The security engineer should primarily focus on ensuring NX/XN and ASLR are properly implemented and enabled to protect against executable space injections due to buffer overflows.