이름: Failure to Handle Missing Parameter

If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

일반 정보

취약점 도입 방식

Implementation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

기술

클래스: Not Technology-Specific (Undetermined)

일반적인 결과

범위	영향	가능성
Integrity Confidentiality Availability Access Control	Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity 참고: There is the potential for arbitrary code execution with privileges of the vulnerable program if function parameter list is exhausted.
Availability	DoS: Crash, Exit, or Restart 참고: Potentially a program could fail if it needs more arguments then are available.

관찰된 예시

참고 자료	설명
CVE-2004-0276	Server earlier allows remote attackers to cause a denial of service (crash) via an HTTP request with a sequence of "%" characters and a missing Host field.
CVE-2002-1488	Chat client allows remote malicious IRC servers to cause a denial of service (crash) via a PART message with (1) a missing channel or (2) a channel that the user is not in.
CVE-2002-1169	Proxy allows remote attackers to cause a denial of service (crash) via an HTTP request to helpout.exe with a missing HTTP version numbers.
CVE-2000-0521	Web server allows disclosure of CGI source code via an HTTP request without the version number.
CVE-2001-0590	Application server allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification.
CVE-2003-0239	Chat software allows remote attackers to cause a denial of service via malformed GIF89a headers that do not contain a GCT (Global Color Table) or an LCT (Local Color Table) after an Image Descriptor.
CVE-2002-1023	Server allows remote attackers to cause a denial of service (crash) via an HTTP GET request without a URI.
CVE-2002-1236	CGI crashes when called without any arguments.
CVE-2003-0422	CGI crashes when called without any arguments.
CVE-2002-1531	Crash in HTTP request without a Content-Length field.
CVE-2002-1077	Crash in HTTP request without a Content-Length field.
CVE-2002-1358	Empty elements/strings in protocol test suite affect many SSH2 servers/clients.
CVE-2003-0477	FTP server crashes in PORT command without an argument.
CVE-2002-0107	Resultant infoleak in web server via GET requests without HTTP/1.0 version string.
CVE-2002-0596	GET request with empty parameter leads to error message infoleak (path disclosure).

잠재적 완화 방법

Phases : Build and Compilation
This issue can be simply combated with the use of proper build process.
Phases : Implementation
Forward declare all functions. This is the recommended solution. Properly forward declaration of all used functions will result in a compiler error if too few arguments are sent to a function.

취약점 매핑 메모

근거 : This CWE entry could be deprecated in a future version of CWE.
댓글 : See maintenance notes.

메모

This entry will be deprecated in a future version of CWE. The term "missing parameter" was used in both PLOVER and CLASP, with completely different meanings. However, data from both taxonomies was merged into this entry. In PLOVER, it was meant to cover malformed inputs that do not contain required parameters, such as a missing parameter in a CGI request. This entry's observed examples and classification came from PLOVER. However, the description, demonstrative example, and other information are derived from CLASP. They are related to an incorrect number of function arguments, which is already covered by CWE-685.

제출

이름	조직	날짜	출시일	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

수정 사항

이름	조직	날짜	댓글
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Common_Consequences, Relationships, Observed_Example, Other_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2008-11-24 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2009-03-09 +00:00	added maintenance note: this entry will probably be deprecated
CWE Content Team	MITRE	2009-03-10 +00:00	updated Maintenance_Notes, Other_Notes, Potential_Mitigations
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Observed_Examples, Relationships
CWE Content Team	MITRE	2013-07-17 +00:00	updated Type
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, Demonstrative_Examples
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2024-02-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Relationships, Weakness_Ordinalities

CWE-234 상세 정보

CWE-234