First Assignment
Secure Programming
COMP10068
Coding Standards for Secure Programming
In this assignment, you will solidify your practical skills in, as well as your knowledge of, the elementary components of secure systems programming. The assignment is presented in two parts. In the first part, you are asked to answer two questions using up to 100 words for each. For the second part, you are provided with five C++ programs. You should:
1. Repair any vulnerabilities you find in each C++ program; and
2. Briefly describe (in a separate document) how you completed each repair.
You should work individually. Submit the modified code you develop, along with a single pdf document, as a single zip to Aula by the date noted above. Please do not submit the build directory; executables (*.exe); or any interme- diate object files (*.obj). Only the C++ codes, and the pdf are required.
Question 1
Use approximately 100 words to compare and contrast the following program- ming language constructs in your own words: the execution (call) stack; and the heap (free store).
Question 2
Use approximately 100 words to explain the difference between a vulnerability and an exploit in terms of computer security. You may provide an example to help you explain.
Five Vulnerable Programs
You are provided with 5 C++ files contained within five folders. The five files are noncompliant[1-5] .cpp. Each exhibits a vulnerability which is addressed by a specific SEI CERT C++ Coding Standard rule; which is available in pdf form on the Week 2 Aula page, or online here.
Each program violates at least one of the rules which are provided within the SEI CERT C++ Coding Standard. The rules are organised into 11 different cat- egories. You should begin by selecting one of the five programs; then find which rule is being violated by that program. Use the guidelines provided at the SEI rule description to modify the code and check that the output of your modified program is then as you would expect. Include the modified C++ file for each of the 5 programs. You should not modify the main function.
For each of the five programs, you should create a subsection in your doc- ument, and write 50-100 words on the nature of the vulnerability, and how you fixed it. n.b. For each, you should reference a specific rule and clearly identify its name and number (e.g. ERR52-CPP. Do not use setjmp() or longjmp()).
Submit a zip containing your 5 modified C++ files, and a single pdf docu- ment. The pdf will include the answers to Questions 1 & 2, as well as the five short explanations of each solution, in your own words. Overall, the document will contain around 500 words.
Marking Scheme
The assignment is worth 30% of the marks awarded for the entire module. The following provides a breakdown of the marking scheme:
|
Answer to Question 1
Answer to Question 2
|
3
2
|
|
Modified code for Program 1
Modified code for Program 2
Modified code for Program 3
Modified code for Program 4
Modified code for Program 5
|
3
3
3
3
3
|
|
Report text for Program 1
Report text for Program 2
Report text for Program 3
Report text for Program 4
Report text for Program 5
|
2
2
2
2
2
|