88%
27%
98%
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVSS 3.1 Base Score 8.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
This example demonstrates a shopping interaction in which the user is free to specify the quantity of items to be purchased and a total is calculated.
...The user has no control over the price variable, however the code does not prevent a negative value from being specified for quantity. If an attacker were to provide a negative value, then the user would have their account credited instead of debited.
This example asks the user for a height and width of an m X n game board with a maximum dimension of 100 squares.
.../* board dimensions */die("No integer passed: Die evil hacker!\n");die("No integer passed: Die evil hacker!\n");die("Value too large: Die evil hacker!\n");While this code checks to make sure the user cannot specify large, positive integers and consume too much memory, it does not check for negative values supplied by the user. As a result, an attacker can perform a resource consumption (CWE-400) attack against this program by specifying two, large negative values that will not overflow, resulting in a very large memory allocation (CWE-789) and possibly a system crash. Alternatively, an attacker can provide very large negative values which will cause an integer overflow (CWE-190) and unexpected behavior will follow depending on how the values are treated in the remainder of the program.
The following example shows a PHP application in which the programmer attempts to display a user's birthday and homepage.
echo "Birthday: $birthday<br>Homepage: <a href=$homepage>click here</a>"The programmer intended for $birthday to be in a date format and $homepage to be a valid URL. However, since the values are derived from an HTTP request, if an attacker can trick a victim into clicking a crafted URL with <script> tags providing the values for birthday and / or homepage, then the script will run on the client's browser when the web server echoes the content. Notice that even if the programmer were to defend the $birthday variable by restricting input to integers and dashes, it would still be possible for an attacker to provide a string of the form:
2009-01-09--If this data were used in a SQL statement, it would treat the remainder of the statement as a comment. The comment could disable other security-related logic in the statement. In this case, encoding combined with input validation would be a more useful protection mechanism.
Furthermore, an XSS (CWE-79) attack or SQL injection (CWE-89) are just a few of the potential consequences when input validation is not used. Depending on the context of the code, CRLF Injection (CWE-93), Argument Injection (CWE-88), or Command Injection (CWE-77) may also be possible.
This function attempts to extract a pair of numbers from a user-supplied string.
}
die("Did not specify integer value. Die evil hacker!\n");/* proceed assuming n and m are initialized correctly */This code attempts to extract two integer values out of a formatted, user-supplied input. However, if an attacker were to provide an input of the form:
123:then only the m variable will be initialized. Subsequent use of n may result in the use of an uninitialized variable (CWE-457).
The following example takes a user-supplied value to allocate an array of objects and then operates on the array.
}list[0] = new Widget();die("Negative value supplied for list size, die evil hacker!");This example attempts to build a list from a user-specified value, and even checks to ensure a non-negative value is supplied. If, however, a 0 value is provided, the code will build an array of size 0 and then try to store a new Widget in the first location, causing an exception to be thrown.
This application has registered to handle a URL when sent an intent:
}......
}
}int length = URL.length();...The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called.
While buffer overflow examples can be rather complex, it is possible to have very simple, yet still exploitable, heap-based buffer overflows:
}strcpy(buf, argv[1]);The buffer is allocated heap memory with a fixed size, but there is no guarantee the string in argv[1] will not exceed this size and cause an overflow.
This example applies an encoding procedure to an input string and stores it into a buffer.
}
return dst_buf;die("user string too long, die evil hacker!");
else dst_buf[dst_index++] = user_supplied_string[i];dst_buf[dst_index++] = ';';
/* encode to < */The programmer attempts to encode the ampersand character in the user-controlled string, however the length of the string is validated before the encoding procedure is applied. Furthermore, the programmer assumes encoding expansion will only expand a given character by a factor of 4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure expands the string it is possible to overflow the destination buffer if the attacker provides a string of many ampersands.
In the following C/C++ example the method processMessageFromSocket() will get a message from a socket, placed into a buffer, and will parse the contents of the buffer into a structure that contains the message length and the message body. A for loop is used to copy the message body into a local character string which will be passed to another method for processing.
}
return success;// get message from socket and store into buffer//Ignoring possibliity that buffer > BUFFER_SIZE
success = processMessage(message);// place contents of the buffer into message structure// copy message body into string for processingmessage[index] = msg->msgBody[index];// process messageHowever, the message length variable from the structure is used as the condition for ending the for loop without validating that the message length variable accurately reflects the length of message body. This can result in a buffer over read by reading from memory beyond the bounds of the buffer if the message length variable indicates a length that is longer than the size of a message body (CWE-130).
The following C/C++ example demonstrates a buffer over-read due to a missing NULL terminator. The main method of a pattern matching utility that looks for a specific pattern within a specific file uses the string strncopy() method to copy the command line user input file name and pattern to the Filename and Pattern character arrays respectively.
}Scan_File(Filename, Pattern);/* Validate number of parameters and ensure valid content *//* copy filename parameter to variable, may cause off-by-one overflow *//* copy pattern parameter to variable, may cause off-by-one overflow */However, the code do not take into account that strncpy() will not add a NULL terminator when the source buffer is equal in length of longer than that provide size attribute. Therefore if a user enters a filename or pattern that are the same size as (or larger than) their respective character arrays, a NULL terminator will not be added (CWE-170) which leads to the printf() read beyond the expected end of the Filename and Pattern buffers.
To fix this problem, be sure to subtract 1 from the sizeof() call to allow room for the null byte to be added.
Pattern[31]='\0';strncpy(Pattern, argv[3], sizeof(Pattern)-1);/* copy filename parameter to variable, no off-by-one overflow *//* copy pattern parameter to variable, no off-by-one overflow */ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.
If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.