987
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : Client Server (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability DoS: Amplification
DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
DoS: Resource Consumption (Other)
Sometimes this is a factor in "flood" attacks, but other
types of amplification exist.
High
Potential Mitigations
Phase: Architecture and Design
An application must make resources available to a client commensurate with the client's access
level.
Phase: Architecture and Design
An application must, at all times, keep track of allocated resources and meter their usage
appropriately.
Phase: System Configuration
Consider disabling resource-intensive algorithms on the server side, such as Diffie-Hellman key
exchange.
Effectiveness = High
Business requirements may prevent disabling resource-intensive algorithms.
Demonstrative Examples
Example 1:
This code listens on a port for DNS requests and sends the result to the requesting address.
Example Language: Python (Bad)
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.bind( (UDP_IP,UDP_PORT) )
while true:
data = sock.recvfrom(1024)
if not data:
break
(requestIP, nameToResolve) = parseUDPpacket(data)
record = resolveName(nameToResolve)
sendResponse(requestIP,record)
This code sends a DNS record to a requesting IP address. UDP allows the source IP address to be
easily changed ('spoofed'), thus allowing an attacker to redirect responses to a target, which may
be then be overwhelmed by the network traffic.
Example 2:
This function prints the contents of a specified file requested by a user.
Example Language: PHP (Bad)
function printFile($username,$filename){
//read file into string
CWE Version 4.14
CWE-405: Asymmetric Resource Consumption (Amplification)
CWE-405: Asymmetric Resource Consumption (Amplification)