134
Related Attack Patterns
CAPEC-ID Attack Pattern Name
67 String Format Overflow in syslog()
135 Format String Injection
References
[REF-116]Steve Christey. "Format String Vulnerabilities in Perl Programs". < https://seclists.org/
fulldisclosure/2005/Dec/91 >.2023-04-07.
[REF-117]Hal Burch and Robert C. Seacord. "Programming Language Format String
Vulnerabilities". < https://drdobbs.com/security/programming-language-format-stringvulne/
197002914 >.2023-04-07.
[REF-118]Tim Newsham. "Format String Attacks". 2000 September 9. Guardent. < http://
www.thenewsh.com/~newsham/format-string-attacks.pdf >.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-962]Object Management Group (OMG). "Automated Source Code Security Measure
(ASCSM)". 2016 January. < http://www.omg.org/spec/ASCSM/1.0/ >.
CWE-135: Incorrect Calculation of Multi-Byte String Length
Weakness ID : 135
Structure : Simple
Abstraction : Base
CWE Version 4.14
CWE-135: Incorrect Calculation of Multi-Byte String Length
CWE-135: Incorrect Calculation of Multi-Byte String Length