Question

Each of the following code fragments contains a number of security vulnerabilities. For each fragment, identify these security vulnerabilities and, for each vulnerability, discuss at least one way that it could be improved. Note that in your discussion of how each vulnerability could be improved, you do not need to re-write a new version of the program in C; simply discuss your solution, either in pseudocode or in 1-2 sentences.

a) /* File Descriptor Leak */
#include
#include
int main(int argc, char *argv[]){
char *filePath = argv[0];
char *shellPath = argv[1];
FILE *passwords;
passwords = fopen(filePath, "r");
/* Read the password and do something with it */
/* . . . */
/* Fork and execute alternative shell */
execl(shellPath, "shell", NULL);
}
b) #include
/*
Assume the following function is written for an electronic storefront.
The user will enter the ID of the item to be ordered, as well
as the quantity of units that they would like to purchase.
The program will then lookup the price for the price for the
item using a predefined function, getPriceByID(), and return
the total cost of the order.
*/
int getTotalCost(){
char itemID[9];
int price, unitsOrdered, cost;
printf("Please enter the 9-digit ID of the item to be ordered: ");
scanf("%s", &itemID);
/* lookup the price according to the itemID */
price = getPriceByID(itemID);
printf("Please enter the quantity of units to be ordered: ");
scanf("%d", &unitsOrdered);
cost = price * unitsOrdered;
return cost;
}
c) #include
/* The following function is intended to return a user's full name
by concatenating the user's first and last name into a single string
and then returning that string. */
char *getFullName(char *firstName, char *lastName, int MAX_LEN){
char fullName[MAX_LEN];
strcpy(fullName, firstName);
strcat(fullName, " ");
strcat(fullName, lastName);
return fullName;
}
d) #include
/* The following code snippet runs through the list of CLI arguments
entered and displays them to the console. */
int main(int argc, char *argv[]){
int i;
printf("You've entered the following arguments: ");
for(i = 0; i < argc; i++){
print(argv[i]);
printf("\\");
}
/* ... */
}

Answer 1

Check the explanation

Step-by-step explanation:

a)

1) int main(int argc, char *argv){

argv has always been an array of pointer whereby each and every element points to the command line argument that is passed to the program.

int main(int argc, char *argv[]) {

2) passwords = fopen(filePath, "r");

argv[0] always holds the name of the program currently running i.e. itself

So you shouldn't even try not to open a executable file for reading. since doing this will not give error but you won't be able to read the file as it is a binary file.

it is god to always check whether the file was opened successfully or not after opening the file. If file was not opened successfully fopen will return NULL.

passwords = fopen(filePath, "r");

if(passwords == NULL)

{

printf(“\\ Unable to open file”);

return -1;

}

3) execl(shellPath, "shell", NULL);

Before making a call to execl you should close the open file

close(passwords);

b)

1) char itemID[9];

After creating a char array one should always initialize the array as it may contain some garbage value.

char itemID[9] = “”;

2) scanf("%d", &unitsOrdered);

Since unitOrdered represents the quantity, it should always be non zero and non negative

c)

1) char fullName[MAX_LEN];

MAX_LEN should not be zero or negative as it used to define the size.

If ( MAX_LEN <=0 )

{

return error;

}

else

{

char fullName[MAX_LEN]

}

2) strcpy(fullName, firstName);

Before using the string functions you're expected to always make sure that the pointer that you are passing to the functions should not be NULL i.e. the pointers should always pass to certain memory location.

if (firstName && lastName)

{

strcpy(fullName, firstName);

strcat(fullName, " ");

strcat(fullName, lastName);

return fullName;

}

else

{

return error;

}