CWE-405: Asymmetric Resource Consumption (Amplification) Asymmetric Resource Consumption (Amplification)
Weakness ID: 405 (Weakness Class) Status: Incomplete
Description
Description Summary
Software that does not appropriately monitor or control resource consumption can lead to adverse system performance.
Extended Description
This situation is amplified if the software allows malicious users or attackers to consume more resources than their access level permits. Exploiting such a weakness can lead to asymmetric resource consumption, aiding in amplification attacks against the system or the network.
Time of Introduction
Operation
Architecture and Design
Implementation
Common Consequences
Scope Effect Availability
Technical Impact: DoS: amplification; DoS: resource consumption
(other)
Sometimes this is a factor in "flood" attacks, but other types of
amplification exist.
Potential Mitigations
Phase: Architecture and Design
An application must make resources available to a client commensurate
with the client's access level.
Phase: Architecture and Design
An application must, at all times, keep track of allocated resources
and meter their usage appropriately.
Relationships
Functional Areas
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Asymmetric resource consumption
(amplification) OWASP Top Ten 2004 A9 CWE_More_Specific Denial of Service WASC 41 XML Attribute Blowup CERT Java Secure Coding TPS00-J Use thread pools to enable graceful degradation of service
during traffic bursts CERT Java Secure Coding FIO04-J Release resources when they are no longer
needed
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time_of_Introduction 2008-09-08 CWE Content Team MITRE Internal updated Relationships, Other_Notes,
Taxonomy_Mappings 2008-10-14 CWE Content Team MITRE Internal updated Description 2009-07-27 CWE Content Team MITRE Internal updated Common_Consequences,
Other_Notes 2010-02-16 CWE Content Team MITRE Internal updated Taxonomy_Mappings 2010-12-13 CWE Content Team MITRE Internal updated Description 2011-06-01 CWE Content Team MITRE Internal updated Common_Consequences, Relationships,
Taxonomy_Mappings 2011-06-27 CWE Content Team MITRE Internal updated Common_Consequences 2012-05-11 CWE Content Team MITRE Internal updated Relationships,
Taxonomy_Mappings 2012-10-30 CWE Content Team MITRE Internal updated Potential_Mitigations
Description
