Unit 4ThreatsObjective 2.38 min read

Application and Operating System Vulnerabilities

Unit 4: Vulnerabilities. Lesson 13 of 54 in SecPlus Academy.

A vulnerability is a weakness that a threat can exploit. Application and operating system flaws are the largest class, and most have a recognizable shape.

Memory problems

Buffer overflow: a program copies more data into a memory buffer than it holds. The extra data overwrites neighboring memory, and a crafted input can overwrite the return address so the attacker's code runs. Defense: patched software, input length checks, memory-safe languages, and operating system protections such as address space layout randomization.
Memory injection: attacker code is written into a running process's memory and executed under that process's privileges, hiding from file-based antivirus.

Timing problems

Race condition: two operations run at once and the outcome depends on which finishes first. The classic form is time-of-check to time-of-use (TOC/TOU): a program checks that a file is safe, then uses it a moment later, and the attacker swaps it in between. Defense: check and use in one atomic step, lock the resource.

Update problems

Malicious update: a legitimate update channel delivers a poisoned package. Because the update is signed or comes from a trusted source, it installs everywhere. Defense: verify signatures, monitor the vendor, stage updates before wide rollout.

Operating system vulnerabilities

Unpatched kernels and services, insecure default settings, unnecessary services running, weak permissions on system files. The fix is boring and decisive: patch on a schedule, apply a secure baseline, remove what is not needed, and monitor for drift.

The objective calls these OS-based vulnerabilities.

Reading the scenario

"Input longer than expected crashed the service, then arbitrary code ran": buffer overflow.
"The file was verified and then replaced before it was used": TOC/TOU race condition.
"Malware appeared through the vendor's normal update": malicious update.
"The exploit runs in memory and leaves nothing on disk": memory injection.

Exam tip: buffer overflow and memory injection are fixed by patching and memory protections, not by firewalls. A race condition is a logic flaw in the code itself; only the developer can fix it.

Remember

Buffer overflow: too much input overwrites memory. Memory injection: code planted in a running process. Race condition, TOC/TOU: checked, then swapped, then used. Malicious update: poison through a trusted channel.

Deeper explanation

Application and Operating System Vulnerabilities, explained slowly

Bugs with a shape

A vulnerability is a flaw an attacker can use. Application and operating system flaws are the most common class, and the ones on the exam each have a recognizable shape. Learn the shape and the scenario names itself.

Buffer overflow

A program sets aside a fixed-size area of memory (a buffer) for input, say 64 characters for a name. It copies the input in without checking the length. Send 500 characters and the extra 436 spill over into neighboring memory.

memory:  [ name buffer: 64 bytes ][ other variables ][ return address ]
input:   AAAAAAAAAAAAAAAAAAAAAAAA...AAAAAAAAAAAAAAAAAAAA[ attacker's address ]
result:  the return address now points at the attacker's code

When the function finishes, the processor jumps to the overwritten return address, which the attacker set to point at code they included in the input. The program is now running attacker code with the program's privileges. Defenses: patch the software, check input lengths, write in memory-safe languages, and enable operating system protections such as address space layout randomization and non-executable stacks that make the jump unreliable.

Memory injection

Instead of overflowing, the attacker writes code directly into the memory of a running process and makes the process execute it. Because nothing is written to disk, file-scanning antivirus sees nothing. The code runs with the injected process's privileges, so injecting into a system service is a full compromise. Defense: endpoint detection tools that watch process behavior and memory, not just files; patching the injection vector.

Race conditions and TOC/TOU

A race condition happens when two operations run at the same time and the result depends on which finishes first. The security version is time-of-check to time-of-use:

1. Program checks: "is /tmp/report.txt a normal file the user may read?"  -> yes
2. Attacker, in the microseconds after the check, replaces /tmp/report.txt with a link to /etc/shadow
3. Program uses the file, reading the password hashes it never would have approved

The check was correct at the time; the world changed before the use. Defenses: make check and use a single atomic operation, lock the resource between them, or avoid re-opening by name. This is a logic bug that only the developer can fix; no firewall or patch from elsewhere helps.

Malicious update

The update mechanism is trusted by design: it runs with high privileges and installs on every machine automatically. If an attacker compromises the vendor's build system or signing key, the poisoned update installs everywhere at once. Defenses: verify update signatures, watch vendor security notices, stage updates on a test group before wide rollout, and monitor for unexpected behavior after updates.

Operating system vulnerabilities

Kernels, drivers, and system services have flaws like any software. Unpatched systems, insecure defaults, unnecessary services, and weak permissions on system files are the everyday operating system vulnerabilities. The fix is the routine: patch on a schedule, apply a hardened baseline, remove what is not needed, and detect drift.

Reading the scenario

"Sent a very long string, the service crashed, then a shell opened"     buffer overflow
"The malware runs entirely in memory; the disk is clean"                memory injection
"The file passed validation but was swapped before it was used"         race condition (TOC/TOU)
"The compromise arrived through the vendor's official update"           malicious update
"The server has not been patched in two years"                          OS vulnerability

How the exam asks it

"Which vulnerability allows attacker code to run by exceeding a memory boundary?" Buffer overflow.
"Which attack exploits the gap between validating a resource and using it?" TOC/TOU race condition.
"Malware was distributed through a trusted software update." Malicious update, a supply chain vector.

What to memorize

Buffer overflow: too much input, overwritten return address.
Memory injection: code planted in a running process, nothing on disk.
Race condition, TOC/TOU: checked, swapped, used.
Malicious update: poison through a trusted channel; verify signatures and stage rollouts.