469
if (argc < 3) {
ExitError("Usage: Provide a username and password");
}
authResult = AuthenticateUser(argv[1], argv[2]);
if (authResult == AUTH_SUCCESS) {
DoAuthenticatedTask(argv[1]);
}
else {
ExitError("Authentication failed");
}
}
In AuthenticateUser(), the strncmp() call uses the string length of an attacker-provided inPass
parameter in order to determine how many characters to check in the password. So, if the attacker
only provides a password of length 1, the check will only examine the first byte of the application's
password before determining success.
As a result, this partial comparison leads to improper authentication (CWE-287).
Any of these passwords would still cause authentication to succeed for the "admin" user:
Example Language: (Attack)
p
pa
pas
pass
This significantly reduces the search space for an attacker, making brute force attacks more
feasible.
The same problem also applies to the username, so values such as "a" and "adm" will succeed for
the username.
While this demonstrative example may not seem realistic, see the Observed Examples for CVE
entries that effectively reflect this same weakness.
Observed Examples
Reference Description
CVE-2014-6394 Product does not prevent access to restricted directories due to partial string
comparison with a public directory
https://www.cve.org/CVERecord?id=CVE-2014-6394
CVE-2004-1012 Argument parser of an IMAP server treats a partial command "body[p" as if it is
"body.peek", leading to index error and out-of-bounds corruption.
https://www.cve.org/CVERecord?id=CVE-2004-1012
CVE-2004-0765 Web browser only checks the hostname portion of a certificate when the
hostname portion of the URI is not a fully qualified domain name (FQDN),
which allows remote attackers to spoof trusted certificates.
https://www.cve.org/CVERecord?id=CVE-2004-0765
CVE-2002-1374 One-character password by attacker checks only against first character of real
password.
https://www.cve.org/CVERecord?id=CVE-2002-1374
CVE-2000-0979 One-character password by attacker checks only against first character of real
password.
https://www.cve.org/CVERecord?id=CVE-2000-0979
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-188: Reliance on Data/Memory Layout
CWE-188: Reliance on Data/Memory Layout