#SecurityExplained S-61: CWE-787: Out-of-bounds Write
The Out-of-bounds Write is a software security vulnerability that occurs when the data is written beyond the boundaries (i.e. past the end, before the beginning) of the intended buffer.
1/n
The Out-of-bounds Write is a software security vulnerability that occurs when the data is written beyond the boundaries (i.e. past the end, before the beginning) of the intended buffer.
1/n
2/n
This weakness is also listed in the CWE TOP 25 (2021). This has been given the CWE ID as CWE-787
- This vulnerability could result in buffer overflows, memory corruption, the crash of the software or even a code execution.
This weakness is also listed in the CWE TOP 25 (2021). This has been given the CWE ID as CWE-787
- This vulnerability could result in buffer overflows, memory corruption, the crash of the software or even a code execution.
3/n
As per the cwe.mitre.org, The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
As per the cwe.mitre.org, The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
4/n
- An alternate term for this weakness is Memory Corruption. CWE website defines memory corruption as, The generic term "memory corruption" is often used to describe the consequences of writing to memory outside the bounds of a buffer, or to memory that is invalid.....
- An alternate term for this weakness is Memory Corruption. CWE website defines memory corruption as, The generic term "memory corruption" is often used to describe the consequences of writing to memory outside the bounds of a buffer, or to memory that is invalid.....
5/n
when the root cause is something other than a sequential copy of excessive data from a fixed starting location. This may include issues such as incorrect pointer arithmetic, accessing invalid pointers due to incomplete initialization or memory release, etc.
when the root cause is something other than a sequential copy of excessive data from a fixed starting location. This may include issues such as incorrect pointer arithmetic, accessing invalid pointers due to incomplete initialization or memory release, etc.
6/n
- This weakness is usually introduced while the implementation phase of the software. This type of attack is majorly observed in software based on C and C++ programming languages.
- This weakness is usually introduced while the implementation phase of the software. This type of attack is majorly observed in software based on C and C++ programming languages.
7/n
# Example Code
- The following is an example of code that may result in a buffer underwrite if find() returns a negative value to indicate that ch is not found in srcBuf:
```
int main() {
...
strncpy(destBuf, &srcBuf[find(srcBuf, ch)], 1024);
...
}
```
# Example Code
- The following is an example of code that may result in a buffer underwrite if find() returns a negative value to indicate that ch is not found in srcBuf:
```
int main() {
...
strncpy(destBuf, &srcBuf[find(srcBuf, ch)], 1024);
...
}
```
8/n
- If the index to srcBuf is somehow under user control, this is an arbitrary write-what-where condition.
- This vulnerability can be detected using manual and automated static as well as dynamic analysis using fuzzing techniques.
- If the index to srcBuf is somehow under user control, this is an arbitrary write-what-where condition.
- This vulnerability can be detected using manual and automated static as well as dynamic analysis using fuzzing techniques.
n/n
A piece of more detailed information about this vulnerability can be found here: cwe.mitre.org/data/definitio…
#appsec #infosec #bugbounty #bugbountytips #softwaresecurity #websecurity #vulnerabilities #appsecurity #websecurity
A piece of more detailed information about this vulnerability can be found here: cwe.mitre.org/data/definitio…
#appsec #infosec #bugbounty #bugbountytips #softwaresecurity #websecurity #vulnerabilities #appsecurity #websecurity
• • •
Missing some Tweet in this thread? You can try to
force a refresh
