CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
Modes of Introduction
Phase | Note |
---|---|
Implementation |
Applicable Platforms
Type | Class | Name | Prevalence |
---|---|---|---|
Language | C | ||
Language | C++ | ||
Language | Assembly |
Relationships
View | Weakness | |||||||
---|---|---|---|---|---|---|---|---|
# ID | View | Status | # ID | Name | Abstraction | Structure | Status | |
CWE-1000 | Research Concepts | Draft | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Class | Simple | Stable | |
CWE-1003 | Weaknesses for Simplified Mapping of Published Vulnerabilities | Incomplete | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Class | Simple | Stable | |
CWE-1305 | CISQ Quality Measures (2020) | Incomplete | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Class | Simple | Stable | |
CWE-1340 | CISQ Data Protection Measures | Incomplete | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Class | Simple | Stable | |
CWE-1000 | Research Concepts | Draft | CWE-123 | Write-what-where Condition | Base | Simple | Draft | |
CWE-700 | Seven Pernicious Kingdoms | Incomplete | CWE-20 | Improper Input Validation | Class | Simple | Stable |
Common Attack Pattern Enumeration and Classification (CAPEC)
The Common Attack Pattern Enumeration and Classification (CAPECâ„¢) effort provides a publicly available catalog of common attack patterns that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities.
CAPEC at Mitre.org# ID | Name | Weaknesses |
---|---|---|
CAPEC-8 | Buffer Overflow in an API Call | CWE-120 |
CAPEC-9 | Buffer Overflow in Local Command-Line Utilities | CWE-120 |
CAPEC-10 | Buffer Overflow via Environment Variables | CWE-120 |
CAPEC-14 | Client-side Injection-induced Buffer Overflow | CWE-120 |
CAPEC-24 | Filter Failure through Buffer Overflow | CWE-120 |
CAPEC-42 | MIME Conversion | CWE-120 |
CAPEC-44 | Overflow Binary Resource File | CWE-120 |
CAPEC-45 | Buffer Overflow via Symbolic Links | CWE-120 |
CAPEC-46 | Overflow Variables and Tags | CWE-120 |
CAPEC-47 | Buffer Overflow via Parameter Expansion | CWE-120 |
CAPEC-67 | String Format Overflow in syslog() | CWE-120 |
CAPEC-92 | Forced Integer Overflow | CWE-120 |
CAPEC-100 | Overflow Buffers | CWE-120 |
CVEs Published
CVSS Severity
CVSS Severity - By Year
CVSS Base Score
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |