CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

Read Time:27 Second

Description

The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.

Modes of Introduction:

– Implementation

Related Weaknesses

CWE-20

Consequences

Other: Varies by Context

Potential Mitigations

Phase: Implementation

Effectiveness: High

Description:

CVE References

CVE-2005-0369
- large ID in packet used as array index

CVE-2001-1009
- negative array index as argument to POP LIST command

InCVE-2005-0369, CWE- 1285, Improper Validation of Specified Index, or Offset in Input, Position

The Most Dangerous Vulnerabilities in Apache Tomcat and How to Protect Against Them

Apache Tomcat is an open-source web server and servlet container that is widely used in enterprise environments to run Java...

rocco

February 19, 2023February 19, 2023

ZDI-CAN-18333: A Critical Zero-Day Vulnerability in Microsoft Windows

Zero-day vulnerabilities are a serious threat to cybersecurity, as they can be exploited by malicious actors to gain unauthorized access...

rocco

February 19, 2023February 19, 2023

CWE-669 – Incorrect Resource Transfer Between Spheres

Description The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere,...

rocco

May 26, 2022