CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
常见后果
影响范围: Integrity Confidentiality Availability
技术影响: Modify Memory Execute Unauthorized Code or Commands
说明: Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
影响范围: Availability
技术影响: Modify Memory DoS: Crash, Exit, or Restart DoS: Resource Consumption (CPU)
说明: Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.
潜在缓解措施
阶段: Requirements
策略: Language Selection
阶段: Architecture and Design
策略: Libraries or Frameworks
阶段: Operation Build and Compilation
策略: Environment Hardening
有效性: Defense in Depth
阶段: Implementation
阶段: Implementation
策略: Input Validation
阶段: Architecture and Design
描述: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
阶段: Operation Build and Compilation
策略: Environment Hardening
有效性: Defense in Depth
阶段: Operation
策略: Environment Hardening
有效性: Defense in Depth
阶段: Build and Compilation Operation
描述: Most mitigating technologies at the compiler or OS level to date address only a subset of buffer overflow problems and rarely provide complete protection against even that subset. It is good practice to implement strategies to increase the workload of an attacker, such as leaving the attacker to guess an unknown value that changes every program execution.
阶段: Implementation
描述: Replace unbounded copy functions with analogous functions that support length arguments, such as strcpy with strncpy. Create these if they are not available.
有效性: Moderate
阶段: Architecture and Design
策略: Enforcement by Conversion
描述: When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
阶段: Architecture and Design Operation
策略: Environment Hardening
描述: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
阶段: Architecture and Design Operation
策略: Sandbox or Jail
有效性: Limited
检测方法
方法: Automated Static Analysis
有效性: High
方法: Automated Dynamic Analysis
This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
方法: Manual Analysis
Manual analysis can be useful for finding this weakness, but it might not achieve desired code coverage within limited time constraints. This becomes difficult for weaknesses that must be considered for all inputs, since the attack surface can be too large.
方法: Automated Static Analysis - Binary or Bytecode
有效性: High
方法: Manual Static Analysis - Binary or Bytecode
有效性: SOAR Partial
方法: Dynamic Analysis with Automated Results Interpretation
有效性: SOAR Partial
方法: Dynamic Analysis with Manual Results Interpretation
有效性: SOAR Partial
方法: Manual Static Analysis - Source Code
有效性: SOAR Partial
方法: Automated Static Analysis - Source Code
有效性: High
方法: Architecture or Design Review
有效性: High
观察示例
参考: CVE-2000-1094
buffer overflow using command with long argument
参考: CVE-1999-0046
buffer overflow in local program using long environment variable
参考: CVE-2002-1337
buffer overflow in comment characters, when product increments a counter for a ">" but does not decrement for "<"
参考: CVE-2003-0595
By replacing a valid cookie value with an extremely long string of characters, an attacker may overflow the application's buffers.
参考: CVE-2001-0191
By replacing a valid cookie value with an extremely long string of characters, an attacker may overflow the application's buffers.
引入模式
| 阶段 | 说明 |
|---|---|
| Implementation | - |
适用平台
编程语言
分类映射
| 分类名称 | 条目ID | 条目名称 | 映射适配度 |
|---|---|---|---|
| PLOVER | - | Unbounded Transfer ('classic overflow') | - |
| 7 Pernicious Kingdoms | - | Buffer Overflow | - |
| CLASP | - | Buffer overflow | - |
| OWASP Top Ten 2004 | A1 | Unvalidated Input | CWE More Specific |
| OWASP Top Ten 2004 | A5 | Buffer Overflows | CWE More Specific |
| CERT C Secure Coding | STR31-C | Guarantee that storage for strings has sufficient space for character data and the null terminator | Exact |
| WASC | 7 | Buffer Overflow | - |
| Software Fault Patterns | SFP8 | Faulty Buffer Access | - |
| OMG ASCSM | ASCSM-CWE-120 | - | |
| OMG ASCRM | ASCRM-CWE-120 | - |
关键信息
CWE ID: CWE-120
抽象级别: Base
结构: Simple
状态: Incomplete
利用可能性: High