311
gethostbyaddr method, copy the hostname of the client that connected to a local variable and
output the hostname of the client to a log file.
Example Language: C (Bad)
...
struct hostent *clienthp;
char hostname[MAX_LEN];
// create server socket, bind to server address and listen on socket
...
// accept client connections and process requests
int count = 0;
for (count = 0; count < MAX_CONNECTIONS; count++) {
int clientlen = sizeof(struct sockaddr_in);
int clientsocket = accept(serversocket, (struct sockaddr *)&clientaddr, &clientlen);
if (clientsocket >= 0) {
clienthp = gethostbyaddr((char*) &clientaddr.sin_addr.s_addr, sizeof(clientaddr.sin_addr.s_addr), AF_INET);
strcpy(hostname, clienthp->h_name);
logOutput("Accepted client connection from host ", hostname);
// process client request
...
close(clientsocket);
}
}
close(serversocket);
...
However, the hostname of the client that connected may be longer than the allocated size for the
local hostname variable. This will result in a buffer overflow when copying the client hostname to
the local variable using the strcpy method.
Observed Examples
Reference Description
CVE-2000-1094 buffer overflow using command with long argument
https://www.cve.org/CVERecord?id=CVE-2000-1094
CVE-1999-0046 buffer overflow in local program using long environment variable
https://www.cve.org/CVERecord?id=CVE-1999-0046
CVE-2002-1337 buffer overflow in comment characters, when product increments a counter for
a ">" but does not decrement for "<"
https://www.cve.org/CVERecord?id=CVE-2002-1337
CVE-2003-0595 By replacing a valid cookie value with an extremely long string of characters,
an attacker may overflow the application's buffers.
https://www.cve.org/CVERecord?id=CVE-2003-0595
CVE-2001-0191 By replacing a valid cookie value with an extremely long string of characters,
an attacker may overflow the application's buffers.
https://www.cve.org/CVERecord?id=CVE-2001-0191
Functional Areas
• Memory Management
Affected Resources
• Memory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
CWE Version 4.14
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')