Which of the following is a software vulnerability that can be avoided by using input validation?
A.
Buffer overflow
B.
Application fuzzing
C.
Incorrect input
D.
Error handling
Which of the following is a software vulnerability that can be avoided by using input validation?
Which of the following is a software vulnerability that can be avoided by using input validation?
buffer overflow
agree
i think also buffer overflow
wrong, its
C. Incorrect input
thats not a vulterability
(-) Buffer overflow
Threat Not a Vulnerability
(-) Application fuzzing
This is a form of testing
(X) Incorrect input
This is the underlying vulnerability that would allow for a buffer overflow and would be exposed in fuzzing.
(-) Error handling
Helps avoid unpredictable states
u got it all wrong, input validation is not a vulnerability nor its a threat
http://www.testingsecurity.com/input-validation
Buffer overflow is a vulnerability and input validation prevents exploitation.
Input validation is a defensive technique intended to mitigate against possible user input attacks, such as buffer overflows and fuzzing. Input validation checks every user input submitted to the application before processing that input. The check could be a length, a character type, a language type, or a domain.
Buffer overflow is an exploit at programming error, bugs and flaws. It occurs when an application is fed more input data than it is programmed to handle. This may cause the application to terminate or to write data beyond the end of the allocated space in memory. The termination of the application may cause the system to send the data with temporary access to privileged levels in the system, while overwriting can cause important data to be lost. Proper error and exception handling and input validation will help prevent Buffer overflow exploits.
Fuzzing is a software testing technique that involves providing invalid, unexpected, or random data to as inputs to a computer program. The program is then monitored for exceptions such as crashes, or failed validation, or memory leaks.
Incorrect input is NOT considered a software vulnerability. Imagine I type my credit card number by mistake on the credit card column. Is it considered a software vulnerability?
Error handling is an aspect of secure coding. When errors occur, the system should revert back to a secure state. This must be coded into the system, and should include error and exception handling.
This is an ambiguous question because there are two correct answers: Buffer overflow and Application fuzzing. If I must pick one, I would pick Buffer overflow because it is more common. However, the author picks C and it is definitely wrong.