1460
If the application is unable to extract the state information - say, due to a database timeout - then
the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as
equivalent to "0" in the conditional, allowing the original user to perform administrator actions. Even
if the attacker cannot directly influence the state data, unexpected errors could cause incorrect
privileges to be assigned to a user just by accident.
Example 3:
The following code intends to concatenate a string to a variable and print the string.
Example Language: C (Bad)
char str[20];
strcat(str, "hello world");
printf("%s", str);
This might seem innocent enough, but str was not initialized, so it contains random memory. As a
result, str[0] might not contain the null terminator, so the copy might start at an offset other than 0.
The consequences can vary, depending on the underlying memory.
If a null terminator is found before str[8], then some bytes of random garbage will be printed before
the "hello world" string. The memory might contain sensitive information from previous uses, such
as a password (which might occur as a result of CWE-14 or CWE-244). In this example, it might not
be a big deal, but consider what could happen if large amounts of memory are printed out before
the null terminator is found.
If a null terminator isn't found before str[8], then a buffer overflow could occur, since strcat will first
look for the null terminator, then copy 12 bytes starting with that location. Alternately, a buffer overread
might occur (CWE-126) if a null terminator isn't found before the end of the memory segment
is reached, leading to a segmentation fault and crash.
Observed Examples
Reference Description
CVE-2001-1471 chain: an invalid value prevents a library file from being included, skipping
initialization of key variables, leading to resultant eval injection.
https://www.cve.org/CVERecord?id=CVE-2001-1471
CVE-2008-3637 Improper error checking in protection mechanism produces an uninitialized
variable, allowing security bypass and code execution.
https://www.cve.org/CVERecord?id=CVE-2008-3637
CVE-2008-4197 Use of uninitialized memory may allow code execution.
https://www.cve.org/CVERecord?id=CVE-2008-4197
CVE-2008-2934 Free of an uninitialized pointer leads to crash and possible code execution.
https://www.cve.org/CVERecord?id=CVE-2008-2934
CVE-2007-3749 OS kernel does not reset a port when starting a setuid program, allowing local
users to access the port and gain privileges.
https://www.cve.org/CVERecord?id=CVE-2007-3749
CVE-2008-0063 Product does not clear memory contents when generating an error message,
leading to information leak.
https://www.cve.org/CVERecord?id=CVE-2008-0063
CVE-2008-0062 Lack of initialization triggers NULL pointer dereference or double-free.
https://www.cve.org/CVERecord?id=CVE-2008-0062
CVE-2008-0081 Uninitialized variable leads to code execution in popular desktop application.
https://www.cve.org/CVERecord?id=CVE-2008-0081
CVE-2008-3688 chain: Uninitialized variable leads to infinite loop.
https://www.cve.org/CVERecord?id=CVE-2008-3688
CVE-2008-3475 chain: Improper initialization leads to memory corruption.
https://www.cve.org/CVERecord?id=CVE-2008-3475
CWE Version 4.14
CWE-665: Improper Initialization
CWE-665: Improper Initialization