1357
Scope Impact Likelihood
Confidentiality
Integrity
Read Application Data
Packets from a variety of network services may be stolen
or the services spoofed.
Potential Mitigations
Phase: Policy
Restrict server socket address to known local addresses.
Demonstrative Examples
Example 1:
This code binds a server socket to port 21, allowing the server to listen for traffic on that port.
Example Language: C (Bad)
void bind_socket(void) {
int server_sockfd;
int server_len;
struct sockaddr_in server_address;
/*unlink the socket if already bound to avoid an error when bind() is called*/
unlink("server_socket");
server_sockfd = socket(AF_INET, SOCK_STREAM, 0);
server_address.sin_family = AF_INET;
server_address.sin_port = 21;
server_address.sin_addr.s_addr = htonl(INADDR_ANY);
server_len = sizeof(struct sockaddr_in);
bind(server_sockfd, (struct sockaddr *) &s1, server_len);
}
This code may result in two servers binding a socket to same port, thus receiving each other's
traffic. This could be used by an attacker to steal packets meant for another process, such as a
secure FTP server.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 954 SFP Secondary Cluster: Multiple Binds to the Same
Port
888 2397
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP32 Multiple binds to the same port
CWE-606: Unchecked Input for Loop Condition
Weakness ID : 606
Structure : Simple
Abstraction : Base
Description
The product does not properly check inputs that are used for loop conditions, potentially leading to
a denial of service or other consequences because of excessive looping.
CWE Version 4.14
CWE-606: Unchecked Input for Loop Condition
CWE-606: Unchecked Input for Loop Condition