CWE

CWE-763 – Release of Invalid Pointer or Reference

Read Time:57 Second

Description

The application attempts to return a memory resource to the system, but calls the wrong release function or calls the appropriate release function incorrectly.

Modes of Introduction:

– Implementation

Likelihood of Exploit:

 

Related Weaknesses

CWE-404
CWE-404
CWE-404

 

Consequences

Integrity, Availability, Confidentiality: Modify Memory, DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands

This weakness may result in the corruption of memory, and perhaps instructions, possibly leading to a crash. If the corrupted memory can be effectively controlled, it may be possible to execute arbitrary code.

 

Potential Mitigations

Phase: Implementation

Effectiveness:

Description: 

Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().

Phase: Implementation

Effectiveness:

Description: 

When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.

Phase: Architecture and Design

Effectiveness:

Description: 

Phase: Architecture and Design

Effectiveness:

Description: 

Use a language that provides abstractions for memory allocation and deallocation.

Phase: Testing

Effectiveness:

Description: 

Use a tool that dynamically detects memory management problems, such as valgrind.

CVE References

 

CWE

CWE-762 – Mismatched Memory Management Routines

Read Time:44 Second

Description

The application attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.

Modes of Introduction:

– Implementation

Likelihood of Exploit: Low

 

Related Weaknesses

CWE-763
CWE-404

 

Consequences

Integrity, Availability, Confidentiality: Modify Memory, DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands

 

Potential Mitigations

Phase: Implementation

Effectiveness:

Description: 

Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().

Phase: Implementation

Effectiveness:

Description: 

Phase: Architecture and Design

Effectiveness:

Description: 

Phase: Architecture and Design

Effectiveness:

Description: 

Use a language that provides abstractions for memory allocation and deallocation.

Phase: Testing

Effectiveness:

Description: 

Use a tool that dynamically detects memory management problems, such as valgrind.

CVE References

 

CWE

CWE-761 – Free of Pointer not at Start of Buffer

Read Time:55 Second

Description

The application calls free() on a pointer to a memory resource that was allocated on the heap, but the pointer is not at the start of the buffer.

Modes of Introduction:

– Implementation

Likelihood of Exploit:

 

Related Weaknesses

CWE-763
CWE-404

 

Consequences

Integrity, Availability, Confidentiality: Modify Memory, DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands

 

Potential Mitigations

Phase: Implementation

Effectiveness:

Description: 

When utilizing pointer arithmetic to traverse a buffer, use a separate variable to track progress through memory and preserve the originally allocated address for later freeing.

Phase: Implementation

Effectiveness:

Description: 

When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.

Phase: Architecture and Design

Effectiveness:

Description: 

Phase: Architecture and Design

Effectiveness:

Description: 

Use a language that provides abstractions for memory allocation and deallocation.

Phase: Testing

Effectiveness:

Description: 

Use a tool that dynamically detects memory management problems, such as valgrind.

CVE References

 

  • CVE-2019-11930
    • function “internally calls ‘calloc’ and returns a pointer at an index… inside the allocated buffer. This led to freeing invalid memory.”
CWE

CWE-760 – Use of a One-Way Hash with a Predictable Salt

Read Time:1 Minute, 31 Second

Description

The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software uses a predictable salt as part of the input.

In cryptography, salt refers to some random addition of data to an input before hashing to make dictionary attacks more difficult.

Modes of Introduction:

– Implementation

Likelihood of Exploit:

 

Related Weaknesses

CWE-916

 

Consequences

Access Control: Bypass Protection Mechanism

 

Potential Mitigations

Phase: Architecture and Design

Effectiveness: High

Description: 

Phase: Implementation

Effectiveness: Limited

Description: 

If a technique that requires extra computational effort can not be implemented, then for each password that is processed, generate a new random salt using a strong random number generator with unpredictable seeds. Add the salt to the plaintext password before hashing it. When storing the hash, also store the salt. Do not use the same salt for every password.

Be aware that salts will not reduce the workload of a targeted attack against an individual hash (such as the password for a critical person), and in general they are less effective than other hashing techniques such as increasing the computation time or memory overhead. Without a built-in workload, modern attacks can compute large numbers of hashes, or even exhaust the entire space of all possible passwords, within a very short amount of time, using massively-parallel computing and GPU, ASIC, or FPGA hardware.

CVE References

 

  • CVE-2008-4905
    • Blogging software uses a hard-coded salt when calculating a password hash.
  • CVE-2002-1657
    • Database server uses the username for a salt when encrypting passwords, simplifying brute force attacks.
  • CVE-2001-0967
    • Server uses a constant salt when encrypting passwords, simplifying brute force attacks.
  • CVE-2005-0408
    • chain: product generates predictable MD5 hashes using a constant value combined with username, allowing authentication bypass.
CWE

CWE-76 – Improper Neutralization of Equivalent Special Elements

Read Time:54 Second

Description

The software properly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

The software may have a fixed list of special characters it believes is complete. However, there may be alternate encodings, or representations that also have the same meaning. For example, the software may filter out a leading slash (/) to prevent absolute path names, but does not account for a tilde (~) followed by a user name, which on some *nix systems could be expanded to an absolute pathname. Alternately, the software might filter a dangerous “-e” command-line switch when calling an external program, but it might not account for “–exec” or other switches that have the same semantics.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit: High

 

Related Weaknesses

CWE-75

 

Consequences

Other: Other

 

Potential Mitigations

Phase: Requirements

Effectiveness:

Description: 

Programming languages and supporting technologies might be chosen which are not subject to these issues.

Phase: Implementation

Effectiveness:

Description: 

Utilize an appropriate mix of allowlist and denylist parsing to filter equivalent special element syntax from all input.

CVE References

 

CWE

CWE-759 – Use of a One-Way Hash without a Salt

Read Time:1 Minute, 43 Second

Description

The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input.

In cryptography, salt refers to some random addition of data to an input before hashing to make dictionary attacks more difficult.

Modes of Introduction:

– Implementation

Likelihood of Exploit:

 

Related Weaknesses

CWE-916

 

Consequences

Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity

If an attacker can gain access to the hashes, then the lack of a salt makes it easier to conduct brute force attacks using techniques such as rainbow tables.

 

Potential Mitigations

Phase: Architecture and Design

Effectiveness: High

Description: 

Phase: Architecture and Design

Effectiveness: Limited

Description: 

If a technique that requires extra computational effort can not be implemented, then for each password that is processed, generate a new random salt using a strong random number generator with unpredictable seeds. Add the salt to the plaintext password before hashing it. When storing the hash, also store the salt. Do not use the same salt for every password.

Be aware that salts will not reduce the workload of a targeted attack against an individual hash (such as the password for a critical person), and in general they are less effective than other hashing techniques such as increasing the computation time or memory overhead. Without a built-in workload, modern attacks can compute large numbers of hashes, or even exhaust the entire space of all possible passwords, within a very short amount of time, using massively-parallel computing and GPU, ASIC, or FPGA hardware.

Phase: Implementation, Architecture and Design

Effectiveness:

Description: 

When using industry-approved techniques, use them correctly. Don’t cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for preventing common attacks.

CVE References

 

  • CVE-2008-1526
    • Router does not use a salt with a hash, making it easier to crack passwords.
  • CVE-2006-1058
    • Router does not use a salt with a hash, making it easier to crack passwords.
CWE

CWE-758 – Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Read Time:31 Second

Description

The software uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

This can lead to resultant weaknesses when the required properties change, such as when the software is ported to a different platform or if an interaction error (CWE-435) occurs.

Modes of Introduction:

Likelihood of Exploit:

 

Related Weaknesses

CWE-710

 

Consequences

Other: Other

 

Potential Mitigations

CVE References

 

  • CVE-2006-1902
    • Change in C compiler behavior causes resultant buffer overflows in programs that depend on behaviors that were undefined in the C standard.
CWE

CWE-757 – Selection of Less-Secure Algorithm During Negotiation (‘Algorithm Downgrade’)

Read Time:1 Minute, 18 Second

Description

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

When a security mechanism can be forced to downgrade to use a less secure algorithm, this can make it easier for attackers to compromise the software by exploiting weaker algorithm. The victim might not be aware that the less secure algorithm is being used. For example, if an attacker can force a communications channel to use cleartext instead of strongly-encrypted data, then the attacker could read the channel by sniffing, instead of going through extra effort of trying to decrypt the data using brute force techniques.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit:

 

Related Weaknesses

CWE-693

 

Consequences

Access Control: Bypass Protection Mechanism

 

Potential Mitigations

CVE References

 

  • CVE-2006-4302
    • Attacker can select an older version of the software to exploit its vulnerabilities.
  • CVE-2006-4407
    • Improper prioritization of encryption ciphers during negotiation leads to use of a weaker cipher.
  • CVE-2005-2969
    • chain: SSL/TLS implementation disables a verification step (CWE-325) that enables a downgrade attack to a weaker protocol.
  • CVE-2001-1444
    • Telnet protocol implementation allows downgrade to weaker authentication and encryption using an Adversary-in-the-Middle AITM attack.
  • CVE-2002-1646
    • SSH server implementation allows override of configuration setting to use weaker authentication schemes. This may be a composite with CWE-642.
CWE

CWE-756 – Missing Custom Error Page

Read Time:20 Second

Description

The software does not return custom error pages to the user, possibly exposing sensitive information.

Modes of Introduction:

Likelihood of Exploit:

 

Related Weaknesses

CWE-755
CWE-209

 

Consequences

Confidentiality: Read Application Data

Attackers can leverage the additional information provided by a default error page to mount attacks targeted on the framework, database, or other resources used by the application.

 

Potential Mitigations

CVE References

 

CWE

CWE-755 – Improper Handling of Exceptional Conditions

Read Time:31 Second

Description

The software does not handle or incorrectly handles an exceptional condition.

Modes of Introduction:

– Implementation

Likelihood of Exploit: Medium

 

Related Weaknesses

CWE-703

 

Consequences

Other: Other

 

Potential Mitigations

CVE References

 

  • CVE-2021-3011
    • virtual interrupt controller in a virtualization product allows crash of host by writing a certain invalid value to a register, which triggers a fatal error instead of returning an error code
  • CVE-2008-4302
    • Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.

News, Advisories and much more

Exit mobile version