CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Causes

• The following code asks the user to enter their last name and then attempts to store the value entered in the last_name array. The problem with the code above is that it does not restrict or limit the size of the name entered by the user. If the user enters "Very_very_long_last_name" which is 24 characters long, then a buffer overflow will occur since the array can only hold 20 characters total.
• The following code attempts to create a local copy of a buffer to perform some manipulations to the data. However, the programmer does not ensure that the size of the data pointed to by string will fit in the local buffer and copies the data with the potentially dangerous strcpy() function. This may result in a buffer overflow condition if an attacker can influence the contents of the string parameter.
• The code below calls the gets() function to read in data from the command line. However, gets() is inherently unsafe, because it copies all input from STDIN to the buffer without checking size. This allows the user to provide a string that is larger than the buffer size, resulting in an overflow condition.
• In the following example, a server accepts connections from a client and processes the client request. After accepting a client connection, the program will obtain client information using the gethostbyaddr method, copy the hostname of the client that connected to a local variable and output the hostname of the client to a log file. However, the hostname of the client that connected may be longer than the allocated size for the local hostname variable. This will result in a buffer overflow when copying the client hostname to the local variable using the strcpy method.

Remediation

• Requirements: [object Object]
• Architecture and Design: [object Object]
• Operation,Build and Compilation: [object Object]
• Implementation: [object Object]
• Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
• Operation: [object Object]
• Build and Compilation,Operation: Most mitigating technologies at the compiler or OS level to date address only a subset of buffer overflow problems and rarely provide complete protection against even that subset. It is good practice to implement strategies to increase the workload of an attacker, such as leaving the attacker to guess an unknown value that changes every program execution.
• Implementation: Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.

Detection

• Automated Static Analysis: [object Object]
• Automated Dynamic Analysis: This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
• Manual Analysis: Manual analysis can be useful for finding this weakness, but it might not achieve desired code coverage within limited time constraints. This becomes difficult for weaknesses that must be considered for all inputs, since the attack surface can be too large.
• Automated Dynamic Analysis: Use tools that are integrated during compilation to insert runtime error-checking mechanisms related to memory safety errors, such as AddressSanitizer (ASan) for C/C++ [REF-1518].
• Automated Static Analysis - Binary or Bytecode: [object Object]
• Manual Static Analysis - Binary or Bytecode: [object Object]
• Dynamic Analysis with Automated Results Interpretation: [object Object]
• Dynamic Analysis with Manual Results Interpretation: [object Object]

Related CWEs

• CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-123: Write-what-where Condition
• CWE-20: Improper Input Validation
• CWE-787: Out-of-bounds Write
• CWE-787: Out-of-bounds Write
• CWE-787: Out-of-bounds Write
• CWE-170: Improper Null Termination
• CWE-196: Unsigned to Signed Conversion Error
• CWE-231: Improper Handling of Extra Values
• CWE-416: Use After Free
• CWE-456: Missing Initialization of a Variable
• CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer

Related CVEs

Related CVE mappings appear after CVE records are cross-indexed.

ATT&CK Relevance

ATT&CK relevance is shown only when reviewed or responsibly inferred.