Improper protection domain initialization and enforcement Improper choice of initial protection domain (domain) Improper isolation of implementation detail (exposed representations) Improper change (consistency of data over time) Improper naming (naming) Improper deallocation or deletion (residuals)
Classify each of the following vulnerabilities using the PA model. Assume that the classification is
for the implementation level. Remember to justify your answers.
(a) The presence of the “wiz” command in the sendmail program (see Section 24.2.9).
(b) The failure to handle the IFS shell variable by loadmodule (see Section 24.2.9).
(c) The failure to select an Administrator password that was difficult to guess (see Section 24.2.10).
(d) The failure of the Burroughs system to detect offline changes to files (see Section 24.2.7)
PA :
-
Improper protection domain initialization and enforcement
-
Improper choice of initial protection domain (domain)
-
Improper isolation of implementation detail (exposed representations)
-
Improper change (consistency of data over time)
-
Improper naming (naming)
-
Improper deallocation or deletion (residuals)
-
-
Improper validation (validation of operands, queue management dependencies)
-
Improper synchronization
-
Improper indivisibility (interrupted atomic operations)
-
Improper sequencing (serialization)
-
-
Improper choice of operand or operation (critical operator selection errors)
Trending now
This is a popular solution!
Step by step
Solved in 2 steps
