Comment out the system(command) statement, and uncomment the execve() statement; the program will use execve() to invoke the command. Recompile the program. Make it a root-owned Set-UID again. Does your attack from Step 1 still work?

Question: Please describe and explain the behaviour change?

Step 2: Comment out the system (command) statement, and uncomment the execve () statement; the program will use execve() to invoke the command. Recompile the program. Make it a root-owned Set-UID again. Does your attack from Step 1 still work? Question: Please describe and explain the behaviour change. #include dinelude #include #include int main(int arge, char *argvl) ( char *v[3]; char *command: if(arge v[1] - argy [11; v12) - NULL; command = malloc(strlen(v[0]) + strlen([1]) + 2); sprintf (command, 4ss", v101, v[1]); / Use only one of the following commands in each test. */ system (command); W execve (v[0], , NULL); return 0; Code Listing 8: Program to 'cat' a file. Step 1: Compile the program in Code Listing 8, make it a root- owned Set-UID program. Initially, the program will use the system () command to invoke the /bin/cat command. Without modifying the code exploit the security flaw in the program and gain a root shell prompt. Demonstrate your attack and describe how it works. Step 2: Comment out the system (command) statement, and uncomment the execve () statement; the program will use execve() to invoke the command. Recompile the program. Make it a root-owned Set-UID again. Does your attack from Step 1 still work? Question: Please describe and explain the behaviour change