999
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 399 Resource Management Errors 2324
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability
Integrity
Other
DoS: Crash, Exit, or Restart
Other
Floods often cause a crash or other problem besides
denial of the resource itself; these are likely examples of
*other* vulnerabilities, not an insufficient resource pool.
Potential Mitigations
Phase: Architecture and Design
Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
Phase: Architecture and Design
Consider implementing a velocity check mechanism which would detect abusive behavior.
Phase: Operation
Consider load balancing as an option to handle heavy loads.
Phase: Implementation
Make sure that resource handles are properly closed when no longer needed.
Phase: Architecture and Design
Identify the system's resource intensive operations and consider protecting them from abuse
(e.g. malicious automated script which runs the resources out).
Demonstrative Examples
Example 1:
In the following snippet from a Tomcat configuration file, a JDBC connection pool is defined with a
maximum of 5 simultaneous connections (with a 60 second timeout). In this case, it may be trivial
for an attacker to instigate a denial of service (DoS) by using up all of the available connections in
the pool.
Example Language: XML (Bad)
<Resource name="jdbc/exampledb"
auth="Container"
type="javax.sql.DataSource"
removeAbandoned="true"
removeAbandonedTimeout="30"
maxActive="5"
maxIdle="5"
maxWait="60000"
username="testuser"
password="testpass"
driverClassName="com.mysql.jdbc.Driver"
url="jdbc:mysql://localhost/exampledb"/>
Observed Examples
Reference Description
CVE-1999-1363 Large number of locks on file exhausts the pool and causes crash.
CWE Version 4.14
CWE-412: Unrestricted Externally Accessible Lock
CWE-412: Unrestricted Externally Accessible Lock