577
Demonstrative Examples
Example 1:
The following example demonstrates the weakness.
Example Language: C (Bad)
foo_funct(one, two);
void foo_funct(int one, int two, int three) {
printf("1) %d\n2) %d\n3) %d\n", one, two, three);
}
Example Language: C (Bad)
void some_function(int foo, ...) {
int a[3], i;
va_list ap;
va_start(ap, foo);
for (i = 0; i < sizeof(a) / sizeof(int); i++) a[i] = va_arg(ap, int);
va_end(ap);
}
int main(int argc, char *argv[]) {
some_function(17, 42);
}
This can be exploited to disclose information with no work whatsoever. In fact, each time this
function is run, it will print out the next 4 bytes on the stack after the two numbers sent to it.
Observed Examples
Reference Description
CVE-2004-0276 Server earlier allows remote attackers to cause a denial of service (crash) via
an HTTP request with a sequence of "%" characters and a missing Host field.
https://www.cve.org/CVERecord?id=CVE-2004-0276
CVE-2002-1488 Chat client allows remote malicious IRC servers to cause a denial of service
(crash) via a PART message with (1) a missing channel or (2) a channel that
the user is not in.
https://www.cve.org/CVERecord?id=CVE-2002-1488
CVE-2002-1169 Proxy allows remote attackers to cause a denial of service (crash) via an HTTP
request to helpout.exe with a missing HTTP version numbers.
https://www.cve.org/CVERecord?id=CVE-2002-1169
CVE-2000-0521 Web server allows disclosure of CGI source code via an HTTP request without
the version number.
https://www.cve.org/CVERecord?id=CVE-2000-0521
CVE-2001-0590 Application server allows a remote attacker to read the source code to arbitrary
'jsp' files via a malformed URL request which does not end with an HTTP
protocol specification.
https://www.cve.org/CVERecord?id=CVE-2001-0590
CVE-2003-0239 Chat software allows remote attackers to cause a denial of service via
malformed GIF89a headers that do not contain a GCT (Global Color Table) or
an LCT (Local Color Table) after an Image Descriptor.
https://www.cve.org/CVERecord?id=CVE-2003-0239
CVE-2002-1023 Server allows remote attackers to cause a denial of service (crash) via an
HTTP GET request without a URI.
https://www.cve.org/CVERecord?id=CVE-2002-1023
CVE-2002-1236 CGI crashes when called without any arguments.
https://www.cve.org/CVERecord?id=CVE-2002-1236
CVE-2003-0422 CGI crashes when called without any arguments.
https://www.cve.org/CVERecord?id=CVE-2003-0422
CWE Version 4.14
CWE-235: Improper Handling of Extra Parameters
CWE-235: Improper Handling of Extra Parameters