Common Attack Pattern Enumeration and Classification

Common Attack Pattern Enumeration and Classification

8

High

The target host exposes an API to the user.

One or more API functions exposed by the target host has a buffer overflow vulnerability.

High

• API Abuse
• Injection

Low : An attacker can simply overflow a buffer by inserting a long string into an attacker-modifiable injection vector. The result can be a DoS. High : Exploiting a buffer overflow to inject malicious code into the stack of a software system or even the heap can require a higher skill level.

Use a language or compiler that performs automatic bounds checking.

Use secure functions not vulnerable to buffer overflow.

If you have to use dangerous functions, make sure that you do boundary checking.

Compiler-based canary mechanisms such as StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete solution.

Use OS-level preventative functionality. Not a complete solution.

• Denial of Service
• Run Arbitrary Code
• Information Leakage
• Data Modification

The user supplied data.

The buffer overrun by the attacker.

When the function returns control to the main program, it jumps to the return address portion of the stack frame. Unfortunately that return address may have been overwritten by the overflowed buffer and the address may contain a call to a privileged command or to a malicious code.

The most common is remote code execution.

Bound checking should be performed when copying data to a buffer.

• Reluctance to trust
• Defense in Depth

Penetration

G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.

CWE – Buffer Errors