An exception is thrown from a function, but it is not caught.
Extended Description
When an exception is not caught, it may cause the program to crash or expose sensitive information.
Time of Introduction
Implementation
Applicable Platforms
Languages
C++
Java
.NET
Common Consequences
Scope
Effect
Availability
Technical Impact: DoS: crash / exit /
restart
Demonstrative Examples
Example 1
The _alloca() function allocates memory on the stack. If an
allocation request is too large for the available stack space, _alloca()
throws an exception. If the exception is not caught, the program will crash,
potentially enabling a denial of service attack. _alloca() has been
deprecated as of Microsoft Visual Studio 2005(R). It has been replaced with
the more secure _alloca_s().
Example 2
EnterCriticalSection() can raise an exception, potentially causing
the program to crash. Under operating systems prior to Windows 2000, the
EnterCriticalSection() function can raise an exception in low memory
situations. If the exception is not caught, the program will crash,
potentially enabling a denial of service attack.
Description
