986
CAPEC-ID Attack Pattern Name
496 ICMP Fragmentation
666 BlueSmacking
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-405: Asymmetric Resource Consumption (Amplification)
Weakness ID : 405
Structure : Simple
Abstraction : Class
Description
The product does not properly control situations in which an adversary can cause the product to
consume or produce excessive resources without requiring the adversary to invest equivalent work
or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
Extended Description
This can lead to poor performance due to "amplification" of resource consumption, typically in a
non-linear fashion. This situation is worsened if the product allows malicious users or attackers to
consume more resources than their access level permits.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 400 Uncontrolled Resource Consumption 964
ParentOf 406 Insufficient Control of Network Message Volume (Network
Amplification)