DetailedSeverity: HighCAPEC-47

CAPEC-47: Buffer Overflow via Parameter Expansion

Description

In this attack, the target software is given input that the adversary knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.

Likelihood of attack: Medium
Typical severity: High
Abstraction: DetailedA low-level, detailed pattern, often for a particular technology.

Mechanism of attack: Manipulate Data Structures

Prerequisites

The program expands one of the parameters passed to a function with input controlled by the user, but a later function making use of the expanded parameter erroneously considers the original, not the expanded size of the parameter.
The expanded parameter is used in the context where buffer overflow may become possible due to the incorrect understanding of the parameter size (i.e. thinking that it is smaller than it really is).

Skills required

HighFinding this particular buffer overflow may not be trivial. Also, stack and especially heap based buffer overflows require a lot of knowledge if the intended goal is arbitrary code execution. Not only that the adversary needs to write the shell code to accomplish their goals, but the adversary also needs to find a way to get the program execution to jump to the planted shell code. There also needs...

Consequences

ConfidentialityAccess ControlAuthorization
Gain Privileges
Availability
Unreliable Execution
Integrity
Modify Data
ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code
Confidentiality
Read Data

Mitigations

Ensure that when parameter expansion happens in the code that the assumptions used to determine the resulting size of the parameter are accurate and that the new size of the parameter is visible to the whole system

Related weaknesses (CWE)

Related attack patterns

Parent

CAPEC-100Overflow BuffersStandard

Prerequisites

The program expands one of the parameters passed to a function with input controlled by the user, but a later function making use of the expanded parameter erroneously considers the original, not the expanded size of the parameter.

The expanded parameter is used in the context where buffer overflow may become possible due to the incorrect understanding of the parameter size (i.e. thinking that it is smaller than it really is).

Skills required

HighFinding this particular buffer overflow may not be trivial. Also, stack and especially heap based buffer overflows require a lot of knowledge if the intended goal is arbitrary code execution. Not only that the adversary needs to write the shell code to accomplish their goals, but the adversary also needs to find a way to get the program execution to jump to the planted shell code. There also needs...