The software's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
Extended Description
Frequently the consequence is a "flood" of connection or sessions.
Time of Introduction
Architecture and Design
Implementation
Operation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Availability
Integrity
Other
Technical Impact: DoS: crash / exit /
restart; Other
Floods often cause a crash or other problem besides denial of the
resource itself; these are likely examples of *other* vulnerabilities,
not an insufficient resource pool.
Demonstrative Examples
Example 1
In the following snippet from a Tomcat configuration file, a JDBC
connection pool is defined with a maximum of 5 simultaneous connections
(with a 60 second timeout). In this case, it may be trivial for an attacker
to instigate a denial of service (DoS) by using up all of the available
connections in the pool.
Large number of connections without providing
credentials allows connection exhaustion.
Potential Mitigations
Phase: Architecture and Design
Do not perform resource-intensive transactions for unauthenticated
users and/or invalid requests.
Phase: Architecture and Design
Consider implementing a velocity check mechanism which would detect
abusive behavior.
Phase: Operation
Consider load balancing as an option to handle heavy loads.
Phase: Implementation
Make sure that resource handles are properly closed when no longer
needed.
Phase: Architecture and Design
Find the resouce intensive operations in your code and consider
protecting them from abuse (e.g. malicious automated script which runs
the resources out).
Other Notes
"Large" is relative to the size of the resource pool, which could be very
small. See examples.
Use thread pools to enable graceful degradation of service
during traffic bursts
References
[REF-11] M. Howard and
D. LeBlanc. "Writing Secure Code". Chapter 17, "Protecting Against Denial of Service Attacks"
Page 517. 2nd Edition. Microsoft. 2002.
Description
