972
more precise mappings are available. Some of its children, such as CWE-771, might be better
considered as a chain.
Theoretical
Vulnerability theory is largely about how behaviors and resources interact. "Resource
exhaustion" can be regarded as either a consequence or an attack, depending on the
perspective. This entry is an attempt to reflect the underlying weaknesses that enable these
attacks (or consequences) to take place.
Other
Database queries that take a long time to process are good DoS targets. An attacker would have
to write a few lines of Perl code to generate enough traffic to exceed the site's ability to keep
up. This would effectively prevent authorized users from using the site at all. Resources can be
exploited simply by ensuring that the target machine must do much more work and consume
more resources in order to service a request than the attacker must do to initiate a request. A
prime example of this can be found in old switches that were vulnerable to "macof" attacks (so
named for a tool developed by Dugsong). These attacks flooded a switch with random IP and
MAC address combinations, therefore exhausting the switch's cache, which held the information
of which port corresponded to which MAC addresses. Once this cache was exhausted, the
switch would fail in an insecure way and would begin to act simply as a hub, broadcasting all
traffic on all ports and allowing for basic sniffing attacks.
Maintenance
The Taxonomy_Mappings to ISA/IEC 62443 were added in CWE 4.10, but they are still under
review and might change in future CWE versions. These draft mappings were performed by
members of the "Mapping CWE to 62443" subgroup of the CWE-CAPEC ICS/OT Special Interest
Group (SIG), and their work is incomplete as of CWE 4.10. The mappings are included to
facilitate discussion and review by the broader ICS/OT community, and they are likely to change
in future CWE versions.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Resource exhaustion (file descriptor,
disk space, sockets, ...)
OWASP Top Ten 2004 A9 CWE More Specific Denial of Service
WASC 10 Denial of Service
WASC 41 XML Attribute Blowup
The CERT Oracle Secure
Coding Standard for Java
(2011)
SER12-J Avoid memory and resource leaks
during serialization
The CERT Oracle Secure
Coding Standard for Java
(2011)
MSC05-J Do not exhaust heap space
Software Fault Patterns SFP13 Unrestricted Consumption
ISA/IEC 62443 Part 3-3 Req SR 7.1
ISA/IEC 62443 Part 3-3 Req SR 7.2
ISA/IEC 62443 Part 4-1 Req SI-1
ISA/IEC 62443 Part 4-1 Req SVV-3
ISA/IEC 62443 Part 4-2 Req CR 7.1
ISA/IEC 62443 Part 4-2 Req CR 7.2
Related Attack Patterns
CAPEC-ID Attack Pattern Name
147 XML Ping of the Death
227 Sustained Client Engagement
CWE Version 4.14
CWE-401: Missing Release of Memory after Effective Lifetime
CWE-401: Missing Release of Memory after Effective Lifetime