293
CAPEC-ID Attack Pattern Name
9 Buffer Overflow in Local Command-Line Utilities
10 Buffer Overflow via Environment Variables
14 Client-side Injection-induced Buffer Overflow
24 Filter Failure through Buffer Overflow
45 Buffer Overflow via Symbolic Links
46 Overflow Variables and Tags
47 Buffer Overflow via Parameter Expansion
CWE-119: Improper Restriction of Operations within the Bounds of a Memory
Buffer
Weakness ID : 119
Structure : Simple
Abstraction : Class
Description
The product performs operations on a memory buffer, but it can read from or write to a memory
location that is outside of the intended boundary of the buffer.
Extended Description
Certain languages allow direct addressing of memory locations and do not automatically ensure
that these locations are valid for the memory buffer that is being referenced. This can cause read or
write operations to be performed on memory locations that may be associated with other variables,
data structures, or internal program data.
As a result, an attacker may be able to execute arbitrary code, alter the intended control flow, read
sensitive information, or cause the system to crash.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 118 Incorrect Access of Indexable Resource ('Range Error') 292
ParentOf 120 Buffer Copy without Checking Size of Input ('Classic Buffer
Overflow')