1771
}
The withdraw method includes a check to ensure that the withdrawal amount does not exceed the
maximum limit allowed, however the method does not check to ensure that the withdrawal amount
is greater than a minimum value (CWE-129). Performing a range check on a value that does not
include a minimum check can have significant security implications, in this case not including a
minimum range check can allow a negative value to be used which would cause the financial
application using this class to deposit money into the user account rather than withdrawing. In this
example the if statement should the modified to include a minimum range check, as shown below.
Example Language: Java (Good)
public class BankAccount {
public final int MINIMUM_WITHDRAWAL_LIMIT = 0;
public final int MAXIMUM_WITHDRAWAL_LIMIT = 350;
...
// method to withdraw amount from BankAccount
public void withdraw(double withdrawAmount) {
if (withdrawAmount < MAXIMUM_WITHDRAWAL_LIMIT &&
withdrawAmount > MINIMUM_WITHDRAWAL_LIMIT) {
...
Note that this example does not protect against concurrent access to the BankAccount balance
variable, see CWE-413 and CWE-362.
While it is out of scope for this example, note that the use of doubles or floats in financial
calculations may be subject to certain kinds of attacks where attackers use rounding errors to steal
money.
Observed Examples
Reference Description
CVE-2010-1866 Chain: integer overflow (CWE-190) causes a negative signed value, which
later bypasses a maximum-only check (CWE-839), leading to heap-based
buffer overflow (CWE-122).
https://www.cve.org/CVERecord?id=CVE-2010-1866
CVE-2009-1099 Chain: 16-bit counter can be interpreted as a negative value, compared to a
32-bit maximum value, leading to buffer under-write.
https://www.cve.org/CVERecord?id=CVE-2009-1099
CVE-2011-0521 Chain: kernel's lack of a check for a negative value leads to memory
corruption.
https://www.cve.org/CVERecord?id=CVE-2011-0521
CVE-2010-3704 Chain: parser uses atoi() but does not check for a negative value, which can
happen on some platforms, leading to buffer under-write.
https://www.cve.org/CVERecord?id=CVE-2010-3704
CVE-2010-2530 Chain: Negative value stored in an int bypasses a size check and causes
allocation of large amounts of memory.
https://www.cve.org/CVERecord?id=CVE-2010-2530
CVE-2009-3080 Chain: negative offset value to IOCTL bypasses check for maximum index,
then used as an array index for buffer under-read.
https://www.cve.org/CVERecord?id=CVE-2009-3080
CVE-2008-6393 chain: file transfer client performs signed comparison, leading to integer
overflow and heap-based buffer overflow.
https://www.cve.org/CVERecord?id=CVE-2008-6393
CVE-2008-4558 chain: negative ID in media player bypasses check for maximum index, then
used as an array index for buffer under-read.
https://www.cve.org/CVERecord?id=CVE-2008-4558
MemberOf Relationships
CWE Version 4.14
CWE-841: Improper Enforcement of Behavioral Workflow
CWE-841: Improper Enforcement of Behavioral Workflow