CWE-605: Multiple Binds to the Same Port
Multiple Binds to the Same Port
Weakness ID: 605 (Weakness Base) Status: Draft
Description
Description Summary
When multiple sockets are allowed to bind to the same port,
other services on that port may be stolen or spoofed.
Time of Introduction
Architecture and Design
Implementation
Operation
Common Consequences
Scope Effect Confidentiality
Integrity
Packets from a variety of network services may be stolen or the
services spoofed.
Demonstrative Examples
Example 1
C
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <stdio.h>
#include <arpa/inet.h>
void bind_socket(void) {
int server_sockfd;
int server_len;
struct sockaddr_in server_address;
unlink("server_socket");
server_sockfd = socket(AF_INET, SOCK_STREAM, 0);
server_address.sin_family = AF_INET;
server_address.sin_port = 21;
server_address.sin_addr.s_addr = htonl(INADDR_ANY);
server_len = sizeof(struct sockaddr_in);
bind(server_sockfd, (struct sockaddr *) &s1,
server_len);
Potential Mitigations
Phase Description Restrict server socket address to known local addresses.
Other Notes
On most systems, a combination of setting the SO_REUSEADDR socket option,
and a call to bind() allows any process to bind to a port to which a
previous process has bound width INADDR_ANY. This allows a user to bind to
the specific address of a server bound to INADDR_ANY on an unprivileged
port, and steal its udp packets/tcp connection.
Relationships
Content History
Submissions Submission Date Submitter Organization Source Anonymous Tool Vendor (under NDA) Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time of Introduction 2008-09-08 CWE Content Team MITRE Internal updated Common Consequences, Relationships, Other Notes,
Taxonomy Mappings 2009-05-27 CWE Content Team MITRE Internal updated Demonstrative Examples 2009-10-29 CWE Content Team MITRE Internal updated Common Consequences
Description
