464 (Weakness Base)

High to Very High

Availability: Generally this error will cause the data structure to not work properly by truncating the data.

Pre-design: Use a language or compiler that performs automatic bounds checking.

Design: Use an abstraction library to abstract away risky APIs. Not a complete solution.

Pre-design through Build: Compiler-based canary mechanisms such as StackGuard, ProPolice, and Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete solution.

Operational: Use OS-level preventative functionality. Not a complete solution.

C/C++ Example:

Data-structure sentinels are often used to mark structure of the data structure. A common example of this is the null character at the end of strings. Another common example is linked lists which may contain a sentinel to mark the end of the list. It is, of course dangerous, to allow this type of control data to be easily accessible. Therefore, it is important to protect from the addition or modification outside of some wrapper interface which provides safety. By adding a sentinel, one potentially could cause data to be truncated early.

CLASP - Addition of data-structure sentinel

C

C++

407 (Weakness Base)

The typical consequence is CPU consumption, but memory consumption and consumption of other resources can also occur.

Similar issues can occur in cryptography.

PLOVER - Algorithmic Complexity

All

294 (Weakness Base)

High

Authorization: Messages sent with a capture-relay attack allow access to resources which are not otherwise accessible without proper authentication.

Design: Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.

C/C++ Example:

Java Example:

Capture-replay attacks are common and can be difficult to defeat without cryptography. They are a subset of network injection attacks that rely listening in on previously sent valid commands, then changing them slightly if necessary and resending the same commands to the server. Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.

PLOVER - Authentication bypass by replay

CLASP - Capture-replay

All

Architecture and Design

290 (Weakness Base)

Resultant vuln from insufficient verification.

PLOVER - Authentication bypass by spoofing

205 (Weakness Base)

Compartmentalize your system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

PLOVER - Behavioral Discrepancy Infoleak

All

124 (Weakness Base)

Some prominent vendors and researchers use the term "buffer underrun". "Buffer underflow" is more commonly used, although both terms are also sometimes used to describe a buffer under-read (CWE-127).

Medium

Primary (Weakness exists independent of other weaknesses)

Explicit (This is an explicit weakness resulting from behavior of the developer)

Availability: Buffer underwrites will very likely result in the corruption of relevant memory, and perhaps instructions, leading to a crash.

Access Control (memory and instruction processing): If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code. If the corrupted memory is data rather than instructions, the system will continue to function with improper changes, possibly in violation of an implicit or explicit policy. The consequences would only be limited by how the affected data is used, such as an adjacent memory location that is used to specify whether the user has special privileges.

Other: When the consequence is arbitrary code execution, this can often be used to subvert any other security service.

Requirements specification: The choice could be made to use a language that is not susceptible to these issues.

Implementation: Sanity checks should be performed on all calculated values used as index or for pointer arithmetic.

The following is an example of code that may result in a buffer underwrite, if find() returns a negative value to indicate that ch is not found in srcBuf:

C Example:

If the index to srcBuf is somehow under user control, this is an arbitrary write-what-where condition.

This could be resultant from several errors, including a bad offset or an array index that decrements before the beginning of the buffer (see CWE-129).

Much attention has been paid to buffer overflows, but "underflows" sometimes exist in products that are relatively free of overflows, so it is likely that this variant has been under-studied.

PLOVER - UNDER - Boundary beginning violation ('buffer underflow' ?)

CLASP - Buffer underwrite

C

C++

Implementation

515 (Weakness Base)

High

Confidentiality: Covert storage channels may provide attackers with important information about the system in question.

Implementation: Ensure that all reserved fields are set to zero before messages are sent and that no unnecessary information is included.

An excellent example of covert storage channels in a well known application is the ICMP error message echoing functionality. Due to ambiguities in the ICMP RFC, many IP implementations use the memory within the packet for storage or calculation. For this reason, certain fields of certain packets -- such as ICMP error packets which echo back parts of received messages -- may contain flaws or extra information which betrays information about the identity of the target operating system. This information is then used to build up evidence to decide the environment of the target. This is the first crucial step in determining if a given system is vulnerable to a particular flaw and what changes must be made to malicious code to mount a successful attack.

Covert storage channels occur when out-of-band data is stored in messages for the purpose of memory reuse. If these messages or packets are sent with the unnecessary data still contained within, it may tip off malicious listeners as to the process that created the message. With this information, attackers may learn any number of things, including the hardware platform, operating system, or algorithms used by the sender. This information can be of significant value to the user in launching further attacks.

Landwehr - Storage

CLASP - Covert storage channel

385 (Weakness Base)

Medium

Confidentiality: Information leakage.

Design: Whenever possible, specify implementation strategies that do not introduce time variances in operations.

Implementation: Often one can artificially manipulate the time which operations take or -- when operations occur -- can remove information from the attacker.

Python Example:

In this example, the attacker can observe how long an authentication takes when the user types in the correct password. When the attacker tries his own values, he can first try strings of various length. When he finds a string of the right length, the computation will take a bit longer because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when he guesses the first character right, the computation will take longer than when he guesses wrong. Such an attack can break even the most sophisticated password with a few hundred guesses. Note that, in this example, the actual password must be handled in constant time, as far as the attacker is concerned, even if the actual password is of an unusual length. This is one reason why it is good to use an algorithm that, among other things, stores a seeded cryptographic one-way hash of the password, then compare the hashes, which will always be of the same length.

Sometimes simply knowing when data is sent between parties can provide a malicious user with information that should be unauthorized. Other times, externally monitoring the timing of operations can reveal sensitive data. For example, some cryptographic operations can leak their internal state if the time it takes to perform the operation changes, based on the state. In such cases, it is good to switch algorithms or implementation techniques. It is also reasonable to add artificial stalls to make the operation take the same amount of raw CPU time in all cases.

Landwehr - Timing

CLASP - Covert Timing Channel

All

379 (Weakness Base)

Low

Confidentiality: Since the file is visible and the application which is using the temp file could be known, the attacker has gained information about what the user is doing at that time.

Requirements specification: Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.

Implementation: Try to store sensitive tempfiles in a directory which is not world readable -- i.e., per-user directories.

Implementation: Avoid using vulnerable temp file functions.

C/C++ Example:

In cygwin and some older unixes one can ls /tmp and see that this temp file exists.

Java Example:

This temp file is readable by all users.

Since the file is visible, the application that is using the temp file could be known. If one has access to list the processes on the system, the attacker has gained information about what the user is doing at that time. By correlating this with the applications the user is running, an attacker could potentially discover what a user's actions are. From this, higher levels of security could be breached.

CLASP - Guessed or visible temporary file

All

212 (Weakness Base)

Compartmentalize your system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.