CAPEC-9: Buffer Overflow in Local Command-Line Utilities
Description
This attack targets command-line utilities available in a number of shells. An adversary can leverage a vulnerability found in a command-line utility to escalate privilege to root.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate Data Structures
Prerequisites
- The target host exposes a command-line utility to the user.
- The command-line utility exposed by the target host has a buffer overflow vulnerability that can be exploited.
Skills required
- LowAn adversary can simply overflow a buffer by inserting a long string into an adversary-modifiable injection vector. The result can be a DoS.
- HighExploiting a buffer overflow to inject malicious code into the stack of a software system or even the heap can require a higher skill level.
Consequences
- ConfidentialityAccess ControlAuthorization
Gain Privileges
- ConfidentialityIntegrityAvailability
Execute Unauthorized Commands
Run Arbitrary Code
- Integrity
Modify Data
- Availability
Unreliable Execution
- Confidentiality
Read Data
Mitigations
- Carefully review the service's implementation before making it available to user. For instance you can use manual or automated code review to uncover vulnerabilities such as buffer overflow.
- Use a language or compiler that performs automatic bounds checking.
- Use an abstraction library to abstract away risky APIs. Not a complete solution.
- Compiler-based canary mechanisms such as StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete solution.
- Operational: Use OS-level preventative functionality. Not a complete solution.
- Apply the latest patches to your user exposed services. This may not be a complete solution, especially against a zero day attack.
- Do not unnecessarily expose services.
Related weaknesses (CWE)
- CWE-20Improper Input Validation
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-118Incorrect Access of Indexable Resource ('Range Error')
- CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- CWE-680Integer Overflow to Buffer Overflow
- CWE-697Incorrect Comparison
- CWE-733Compiler Optimization Removal or Modification of Security-critical Code