Question: In the following program, the return value of a call to the method retrieveFromDB is a secret value, and printf prints the message that
In the following program, the return value of a call to the method "retrieveFromDB" is a secret value, and printf prints the message that an attacker can observe (public). The program is insecure to allow an attacker to observe its secret data. The violation is through implicit information flow. Note that programmers have written the security requirement as the type qualifiers secret and public. Using tainted flow analysis with the lattice public < secret, how would you precisely identify the implicit flow? Write the constraints and try to solve them. secret int retrieveFromDB(...). void printf(public int i). int ret = retriveFromDB(). int tmp: if(ret == 1){ tmp =Q; } else { } tmp = 1; printf(tmp):
Step by Step Solution
There are 3 Steps involved in it
The program snippet displayed in the image contains a security issue due to an implicit information flow This refers to a situation where information ... View full answer
Get step-by-step solutions from verified subject matter experts
