|
|
|
|
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)| | Improper Handling of Highly Compressed Data (Data Amplification) |
|
| Weakness ID: 409 (Weakness Base) | | Status: Incomplete |
 Description
Description Summary The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Extended Description An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
Time of Introduction
- Architecture and Design
- Implementation
Common Consequences | Scope | Effect |
|---|
Availability | Technical Impact: DoS: amplification |
Relationships Taxonomy Mappings | Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|
| PLOVER | | | Data Amplification |
| CERT Java Secure Coding | IDS22-J | | Limit the size of files passed to
ZipInputStream |
Content History | Submissions |
|---|
| Submission Date | Submitter | Organization | Source |
|---|
| PLOVER | | Externally Mined | | | Modifications |
|---|
| Modification Date | Modifier | Organization | Source |
|---|
| 2008-07-01 | Eric Dalci | Cigital | External | | updated Time_of_Introduction | | 2008-09-08 | CWE Content Team | MITRE | Internal | | updated Relationships,
Taxonomy_Mappings | | 2008-10-14 | CWE Content Team | MITRE | Internal | | updated Description | | 2009-05-27 | CWE Content Team | MITRE | Internal | | updated Description, Name | | 2009-07-27 | CWE Content Team | MITRE | Internal | | updated Relationships | | 2011-06-01 | CWE Content Team | MITRE | Internal | | updated Common_Consequences, Relationships,
Taxonomy_Mappings | | Previous Entry Names |
|---|
| Change Date | Previous Entry
Name |
|---|
| 2008-04-11 | Data
Amplification | | | 2009-05-27 | Failure to Handle Highly
Compressed Data (Data Amplification) | |
|
