1867
int authResult;
if (argc < 3) {
ExitError("Usage: Provide a username and password");
}
authResult = AuthenticateUser(argv[1], argv[2]);
if (authResult == AUTH_SUCCESS) {
DoAuthenticatedTask(argv[1]);
}
else {
ExitError("Authentication failed");
}
}
In AuthenticateUser(), the strncmp() call uses the string length of an attacker-provided inPass
parameter in order to determine how many characters to check in the password. So, if the attacker
only provides a password of length 1, the check will only examine the first byte of the application's
password before determining success.
As a result, this partial comparison leads to improper authentication (CWE-287).
Any of these passwords would still cause authentication to succeed for the "admin" user:
Example Language: (Attack)
p
pa
pas
pass
This significantly reduces the search space for an attacker, making brute force attacks more
feasible.
The same problem also applies to the username, so values such as "a" and "adm" will succeed for
the username.
While this demonstrative example may not seem realistic, see the Observed Examples for CVE
entries that effectively reflect this same weakness.
Observed Examples
Reference Description
CVE-2005-2782 PHP remote file inclusion in web application that filters "http" and "https" URLs,
but not "ftp".
https://www.cve.org/CVERecord?id=CVE-2005-2782
CVE-2014-6394 Product does not prevent access to restricted directories due to partial string
comparison with a public directory
https://www.cve.org/CVERecord?id=CVE-2014-6394
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1397 Comprehensive Categorization: Comparison 1400 2523
CWE-1024: Comparison of Incompatible Types
Weakness ID : 1024
Structure : Simple
Abstraction : Base
CWE Version 4.14
CWE-1025: Comparison Using Wrong Factors
CWE-1025: Comparison Using Wrong Factors