Threats, Vulnerabilities, and Mitigations · Topic 4 of 9
Application, OS and Web Vulnerabilities
Security+ software vulnerabilities: buffer overflow, race conditions, SQL injection, XSS, cryptographic flaws, misconfiguration and zero day flaws.
- 4 min
- Buffer overflow writes past a buffer, and memory injection places code in a running process.
- A race condition depends on timing, with TOCTOU as the classic example.
- A malicious update is delivered through a channel that the user trusts.
What it is
A vulnerability is a weakness that an attacker can use to harm a system. This page covers the vulnerabilities found in software: applications, operating systems (OS), web applications and cryptography, along with misconfiguration and zero-day flaws.
Most of these come from mistakes in code, weak design or settings left in an unsafe state. Knowing the name of each flaw and its usual fix is the main exam skill.
How it works
Application vulnerabilities
| Vulnerability | What it is |
|---|---|
| Memory injection | Malicious code is placed into the memory of a running process |
| Buffer overflow | A program writes more data than a buffer can hold, overwriting nearby memory |
| Race condition | Two actions compete, and the outcome depends on timing |
| Malicious update | An update that contains malware, delivered through a trusted channel |
A race condition often takes the form of time of check versus time of use (TOCTOU). The system checks a condition, and the situation changes before it acts on the result.
Buffer overflows are reduced by safe coding, bounds checking and operating system protections such as address space layout randomization (ASLR).
Operating system vulnerabilities
These are flaws in the core system software, such as unpatched kernel bugs or weak default settings. The usual fix is to apply vendor patches promptly and harden the configuration.
Web based vulnerabilities
| Vulnerability | What happens | Main defense |
|---|---|---|
| Structured Query Language injection (SQLi) | Attacker input changes a database query | Parameterized queries, input validation |
| Cross site scripting (XSS) | Attacker script runs in another user's browser | Output encoding, input validation, content security policy |
Cross site scripting can be stored, where the script is kept on the server, or reflected, where it is carried in a request link. SQL injection targets the server side database, while XSS targets other users of the site.
Cryptographic vulnerabilities
Cryptography can fail because of old algorithms, short keys, poor random number generation or a bad implementation. Outdated protocols may also allow a downgrade to a weaker version. The fix is to use current, well reviewed algorithms and to retire old ones.
Misconfiguration
Misconfiguration means settings that expose a system. Examples are open ports, default passwords, overly permissive file sharing and debug features left on.
It is one of the most common causes of breaches, and it can be reduced with secure baselines and configuration checks.
Zero-day vulnerabilities
A zero-day vulnerability is a flaw unknown to the vendor, so no patch exists. Attackers can use it until it is found and fixed.
Defenses are layered controls such as segmentation, behavior based detection and least privilege, because patching is not yet possible.
What to remember for the exam
- Buffer overflow writes past a buffer, and memory injection places code in a running process.
- A race condition depends on timing, with TOCTOU as the classic example.
- A malicious update is delivered through a channel that the user trusts.
- SQL injection is fixed with parameterized queries and input validation.
- XSS runs attacker script in a victim's browser, and output encoding is a key defense.
- Cryptographic weaknesses come from old algorithms, short keys and poor implementation.
- Misconfiguration includes default credentials, open ports and excessive permissions.
- A zero-day has no patch, so use layered defenses until a fix is available.
If the question mentions user input being treated as part of a command, the answer is some form of injection, and the fix is input validation or parameterized queries.
Common mistakes
Mixing up SQL injection and XSS. SQLi attacks the database behind the site. XSS attacks other users who view a page.
Thinking patching solves a zero-day. By definition, no patch exists yet, so compensating controls are needed.
Calling a misconfiguration a software bug. The software works as designed, but the settings leave it exposed.
Trusting updates blindly. Code signing and verification help confirm that an update comes from the real vendor and is unchanged.
Assuming encryption is always strong. Weak or outdated algorithms, or poor key handling, can make encryption nearly useless.
Input validation on the client side alone is not enough, because an attacker can bypass the browser. Validate on the server.
Check yourself
What is the best defense against SQL injection?
Parameterized queries together with server side input validation.
What is a zero-day vulnerability?
A flaw that is unknown to the vendor, so there is no patch available yet.
What distinguishes a race condition?
The result depends on the timing of events, such as a condition changing between being checked and being used.
Topic 4 of 9 in Threats, Vulnerabilities, and Mitigations
Test yourself on Threats, Vulnerabilities, and Mitigations
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.