CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

ID CWE-120
Abstraction Base
Structure Simple
Status Incomplete
Number of CVEs 2508
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.

Modes of Introduction

Phase Note
Implementation

Applicable Platforms

Type Class Name Prevalence
Language C
Language C++
Language Assembly

Relationships

View Weakness
# ID View Status # ID Name Abstraction Structure Status
CWE-1000 Research Concepts Draft CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Class Simple Stable
CWE-1003 Weaknesses for Simplified Mapping of Published Vulnerabilities Incomplete CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Class Simple Stable
CWE-1305 CISQ Quality Measures (2020) Incomplete CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Class Simple Stable
CWE-1340 CISQ Data Protection Measures Incomplete CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Class Simple Stable
CWE-1000 Research Concepts Draft CWE-123 Write-what-where Condition Base Simple Draft
CWE-700 Seven Pernicious Kingdoms Incomplete CWE-20 Improper Input Validation Class Simple Stable

Common Attack Pattern Enumeration and Classification (CAPEC)

The Common Attack Pattern Enumeration and Classification (CAPECâ„¢) effort provides a publicly available catalog of common attack patterns that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities.

CAPEC at Mitre.org
# ID Name Weaknesses
CAPEC-8 Buffer Overflow in an API Call CWE-120
CAPEC-9 Buffer Overflow in Local Command-Line Utilities CWE-120
CAPEC-10 Buffer Overflow via Environment Variables CWE-120
CAPEC-14 Client-side Injection-induced Buffer Overflow CWE-120
CAPEC-24 Filter Failure through Buffer Overflow CWE-120
CAPEC-42 MIME Conversion CWE-120
CAPEC-44 Overflow Binary Resource File CWE-120
CAPEC-45 Buffer Overflow via Symbolic Links CWE-120
CAPEC-46 Overflow Variables and Tags CWE-120
CAPEC-47 Buffer Overflow via Parameter Expansion CWE-120
CAPEC-67 String Format Overflow in syslog() CWE-120
CAPEC-92 Forced Integer Overflow CWE-120
CAPEC-100 Overflow Buffers CWE-120

CVEs Published

CVSS Severity

CVSS Severity - By Year

CVSS Base Score

# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date
Loading...
Loading...