[Forgot Password]
Login  Register Subscribe

23631

 
 

115083

 
 

97147

 
 

909

 
 

78764

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CWE
view XML

Buffer Access Using Size of Source Buffer

ID: 806Date: (C)2012-05-14   (M)2012-11-08
Type: weaknessStatus: INCOMPLETE
Abstraction Type: Variant





Description

The software uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.

Extended Description

When the size of the destination is smaller than the size of the source, a buffer overflow could occur.

Likelihood of Exploit: Medium to High

Applicable Platforms
Language: C
Language: Sometimes
Language: C++
Language: Sometimes

Time Of Introduction

  • Implementation

Common Consequences

ScopeTechnical ImpactNotes
Availability
 
DoS: crash / exit / restart
DoS: resource consumption (CPU)
 
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
 
Integrity
Confidentiality
Availability
 
Execute unauthorized code or commands
 
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy.
 
Access_Control
 
Bypass protection mechanism
 
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
 

Detection Methods
None

Potential Mitigations

PhaseStrategyDescriptionEffectivenessNotes
Architecture and Design
 
 Use an abstraction library to abstract away risky APIs. Examples include the Safe C String Library (SafeStr) by Viega, and the Strsafe.h library from Microsoft. This is not a complete solution, since many buffer overflows are not related to strings.
 
  
Build and Compilation
 
 Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. This is not necessarily a complete solution, since these canary-based mechanisms only detect certain types of overflows. In addition, the result is still a denial of service, since the typical response is to exit the application.
 
  
Implementation
 
 Programmers should adhere to the following rules when allocating and managing their applications memory: Double check that your buffer is as large as you specify. When using functions that accept a number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal to the source buffer size, it may not NULL-terminate the string. Check buffer boundaries if calling this function in a loop and make sure you are not in danger of writing past the allocated space. Truncate all input strings to a reasonable length before passing them to the copy and concatenation functions
 
  
Operation
 
Environment Hardening
 
Use a feature like Address Space Layout Randomization (ASLR) [R.806.3] [R.806.5].
 
Defense in Depth
 
This is not a complete solution. However, it forces the attacker to guess an unknown value that changes every program execution. In addition, an attack could still cause a denial of service, since the typical response is to exit the application.
 
Operation
 
Environment Hardening
 
Use a CPU and operating system that offers Data Execution Protection (NX) or its equivalent [R.806.5] [R.806.6].
 
Defense in Depth
 
This is not a complete solution, since buffer overflows could be used to overwrite nearby variables to modify the software's state in dangerous ways. In addition, it cannot be used in cases in which self-modifying code is required. Finally, an attack could still cause a denial of service, since the typical response is to exit the application.
 
Build and Compilation
Operation
 
 Most mitigating technologies at the compiler or OS level to date address only a subset of buffer overflow problems and rarely provide complete protection against even that subset. It is good practice to implement strategies to increase the workload of an attacker, such as leaving the attacker to guess an unknown value that changes every program execution.
 
  

Relationships

Related CWETypeViewChain
CWE-806 ChildOf CWE-805 Weakness CWE-1000
CWE-699 
 

Demonstrative Examples   (Details)

  1. In the following example, the source character string is copied to the dest character string using the method strncpy.
  2. In this example, the method outputFilenameToLog outputs a filename to a log file. The method arguments include a pointer to a character string containing the file name and an integer for the number of characters in the string. The filename is copied to a buffer where the buffer size is set to a maximum size for inputs to the log file. The method then calls another method to save the contents of the buffer to the log file.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings
None

References:

  1. Microsoft .Using the Strsafe.h Functions.
  2. Matt Messier John Viega .Safe C String Library v1.0.3.
  3. Michael Howard .Address Space Layout Randomization in Windows Vista.
  4. Arjan van de Ven .Limiting buffer overflows with ExecShield.
  5. .PaX.
  6. Microsoft .Understanding DEP as a mitigation technology part 1.

© 2013 SecPod Technologies