In the following program, the return value of a call to the method retrieveFromDB is a...

  

Transcribed Image Text:

In the following program, the return value of a call to the method "retrieveFromDB" is a secret value, and printf prints the message that an attacker can observe (public). The program is insecure to allow an attacker to observe its secret data. The violation is through implicit information flow. Note that programmers have written the security requirement as the type qualifiers secret and public. Using tainted flow analysis with the lattice public < secret, how would you precisely identify the implicit flow? Write the constraints and try to solve them. secret int retrieveFromDB(...). void printf(public int i). int ret = retriveFromDB(). int tmp: if(ret == 1){ tmp =Q; } else { } tmp = 1; printf(tmp): In the following program, the return value of a call to the method "retrieveFromDB" is a secret value, and printf prints the message that an attacker can observe (public). The program is insecure to allow an attacker to observe its secret data. The violation is through implicit information flow. Note that programmers have written the security requirement as the type qualifiers secret and public. Using tainted flow analysis with the lattice public < secret, how would you precisely identify the implicit flow? Write the constraints and try to solve them. secret int retrieveFromDB(...). void printf(public int i). int ret = retriveFromDB(). int tmp: if(ret == 1){ tmp =Q; } else { } tmp = 1; printf(tmp):

Answer rating: 100% (QA)

The program snippet displayed in the image contains a security issue due to an implicit information flow This refers to a situation where information ... View the full answer