CAPEC Definitions / CAPEC-47
CAPEC-47: Buffer Overflow via Parameter Expansion
In this attack, the target software is given input that the adversary knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.
Extended Description
No Extended Description.
Mitigations
Ensure that when parameter expansion happens in the code that the assumptions used to determine the resulting size of the parameter are accurate and that the new size of the parameter is visible to the whole system
Relationships with other CAPECs
CAPEC-100: Overflow Buffers
Prerequisites
The program expands one of the parameters passed to a function with input controlled by the user, but a later function making use of the expanded parameter erroneously considers the original, not the expanded size of the parameter.
The expanded parameter is used in the context where buffer overflow may become possible due to the incorrect understanding of the parameter size (i.e. thinking that it is smaller than it really is).
Related Weaknesses
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-118: Incorrect Access of Indexable Resource ('Range Error')
CWE-130: Improper Handling of Length Parameter Inconsistency
CWE-131: Incorrect Calculation of Buffer Size
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-20: Improper Input Validation
CWE-680: Integer Overflow to Buffer Overflow
CWE-697: Incorrect Comparison
