CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Description

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Common consequences

• Integrity,Confidentiality,Availability→Modify Memory,Execute Unauthorized Code or Commands
  Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
• Availability→Modify Memory,DoS: Crash, Exit, or Restart,DoS: Resource Consumption (CPU)
  Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.

Potential mitigations

• Requirements
  [object Object]
• Architecture and Design
  [object Object]
• Operation,Build and Compilation
  [object Object]
• Implementation
  [object Object]
• Implementation
  [object Object]
• Architecture and Design
  For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
• Operation,Build and Compilation
  [object Object]
• Operation
  [object Object]
• Build and Compilation,Operation
  Most mitigating technologies at the compiler or OS level to date address only a subset of buffer overflow problems and rarely provide complete protection against even that subset. It is good practice to implement strategies to increase the workload of an attacker, such as leaving the attacker to guess an unknown value that changes every program execution.
• Implementation
  Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.

Related CWEs

Recent CVEs classified under this CWE