20 07 17

Pagina 1

Computer Security Exam Professors F. Maggi & S. Zanero Milan, 20/07/2017 Last (family) Name ____________________________ First (given) Name ____________________________ Matricola or Codice Persona ____________________________ Have you done any challenges/homework, even partially? [ ] Yes [ ] No Instructions ● The exam is composed of 12 pages. Check that you have all of them ● Just as a cross check, tell us whether you have completed the homeworks, by putting an "X" mark appropriately. ● The exam is "closed books". Please put away in a non-suspicious place (i.e. not below the desk) any note, book, or similar. You will be expelled if, at any time, if you do not follow this rule. ● You are not allowed to communicate with other students, and you will be expelled from the exam if you do. ● Shut down and store electronic devices. They will be subject to inspection if found and you may be expelled if you are found using one. ● Please answer within the allowed space. Schemes are good, short answers are recommended. ● You can write in pen or pencil, any color, but ​ avoid writing in red ​ . ● No extra paper is allowed. ● The answers should be written exclusively in the space provided below the questions. SOLUTION Answer provided in this solution MUST BE CONSIDERED ONLY AS A HINT for the correct answer, and they are not necessarily complete. Page 1 of 12 Computer Security Exam - 20/07/2017 - Professors F. Maggi & S. Zanero Question 1 (7 points) Consider the C program below, which ​ is affected by a typical buffer overflow vulnerability ​ . 1 ​ #include <stdio.h> 2 ​ #include <stdlib.h> 3 ​ #include <string.h> 4 5 ​ int ​ vuln (int n) { 6 ​ ​ int ​ i; 7 ​ ​ char ​ buffer[20]; 8 9 ​ ​ do ​ { 10 ​ scanf("%s", buffer); 11 12 ​ ​ if ​ (strcmp(buffer, "sesame") == 0) { 13 ​ ​ for ​ (i…