CAPEC-231
Oversized Serialized Data Payloads
2014-06-23
00h00 +00:00
00h00 +00:00
Cảnh báo cho một CAPEC
Luôn được thông báo về mọi thay đổi đối với một CAPEC cụ thể.
Mô tả CAPEC
An adversary injects oversized serialized data payloads into a parser during data processing to produce adverse effects upon the parser such as exhausting system resources and arbitrary code execution.
Thông tin CAPEC
Luồng thực thi
1) Explore
An adversary determines the input data stream that is being processed by an serialized data parser on the victim's side.
2) Experiment
An adversary crafts input data that may have an adverse effect on the operation of the data parser when the data is parsed on the victim's system.
Điều kiện tiên quyết
An application uses an parser for serialized data to perform transformation on user-controllable data.An application does not perform sufficient validation to ensure that user-controllable data is safe for a data parser.
Kỹ năng cần thiết
Denial of serviceArbitrary code execution
Các biện pháp giảm thiểu
Carefully validate and sanitize all user-controllable serialized data prior to passing it to the parser routine. Ensure that the resultant data is safe to pass to the parser.Perform validation on canonical data.
Pick a robust implementation of the serialized data parser.
Validate data against a valid schema or DTD prior to parsing.
Điểm yếu liên quan
| Tên điểm yếu | |
|---|---|
CWE-112 |
Missing XML Validation The product accepts XML from an untrusted source but does not validate the XML against the proper schema. |
CWE-20 |
Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
CWE-674 |
Uncontrolled Recursion The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
CWE-770 |
Allocation of Resources Without Limits or Throttling The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Tài liệu tham khảo
REF-89
XML Parser Attacks: A summary of ways to attack an XML ParserShlomo, Yona.
http://yeda.cs.technion.ac.il/~yona/talks/xml_parser_attacks/slides/slide2.html
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Alternate_Terms, Description, Execution_Flow, Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated @Name, Description, Execution_Flow, Indicators, Mitigations, Prerequisites | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Notes | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Extended_Description |
