Skip to content

Latest commit

 

History

History
25 lines (12 loc) · 1.76 KB

cwe-119.md

File metadata and controls

25 lines (12 loc) · 1.76 KB

SecurityExplained S-95

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Although the software operates on a memory buffer, it can read from or write to memory locations outside of the buffer's intended border.

Buffer errors are frequent in software that uses a memory buffer to execute actions. An attacker may be able to read or write data outside the intended buffer due to a lack of or incorrect validation of input data. Memory corruption is a term used to describe this flaw. Specific languages support direct memory addressing, but they don't always check that the addresses are valid for the referred buffer. As a result, read and write operations on memory regions associated with another buffer, variables, data structures, and so on may be done.

Potential Impact:

An attacker who has complete control over the user input can read or write to any memory location. As a result, it's possible to extract potentially sensitive data from memory and create memory corruption, crash the application, or even run arbitrary code on the target machine.

Use a language that prevents this vulnerability from occurring or provides constructs that make it easy to avoid this weakness.

Buffer overflows are not a problem in many languages that do their memory management, such as Java and Perl. Other languages often provide overflow protection, such as Ada and C#, but the programmer can remove it.

Run or create the software using features or extensions that automatically provide a buffer overflow mitigation or elimination technique.

A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/119.html

Follow Twitter Thread