PCI DSS 6.5.9 covers which threat?

PCI DSS 6.5.9 covers which threat?

• A. Cross-site request forgery (CSRF)
• B. Broken authentication and session management
• C. Cross-site scripting (XSS)
• D. Buffer overflows

Answer: (D)

The main idea here is secure software development focused on preventing memory-safety flaws in code that processes card data. A buffer overflow happens when a program writes more data into a buffer than it can hold, which can corrupt adjacent memory. This type of memory corruption can cause a crash, alter program behavior, or even allow an attacker to run arbitrary code. In payment applications, such a breach could lead to unauthorized access to sensitive cardholder data. So, the best protection is to enforce strict bounds checking, use memory-safe languages or safe libraries, validate input lengths, and apply compiler defenses like stack canaries, address space layout randomization, and non-executable memory regions. These practices directly reduce the risk of memory corruption that attackers could exploit to compromise the application. The other threats mentioned are real concerns in web and application security—things like forged requests, script injections, or weak session handling—but they pertain to different kinds of flaws and attack vectors. The focus of this item is specifically on memory-safety vulnerabilities, which is why buffer overflows are the most relevant issue here.

The main idea here is secure software development focused on preventing memory-safety flaws in code that processes card data. A buffer overflow happens when a program writes more data into a buffer than it can hold, which can corrupt adjacent memory. This type of memory corruption can cause a crash, alter program behavior, or even allow an attacker to run arbitrary code. In payment applications, such a breach could lead to unauthorized access to sensitive cardholder data. So, the best protection is to enforce strict bounds checking, use memory-safe languages or safe libraries, validate input lengths, and apply compiler defenses like stack canaries, address space layout randomization, and non-executable memory regions. These practices directly reduce the risk of memory corruption that attackers could exploit to compromise the application.

The other threats mentioned are real concerns in web and application security—things like forged requests, script injections, or weak session handling—but they pertain to different kinds of flaws and attack vectors. The focus of this item is specifically on memory-safety vulnerabilities, which is why buffer overflows are the most relevant issue here.