1945
Weakness Ordinalities
Indirect :
Primary :
Common Consequences
Scope Impact Likelihood
Other Other
Detection Methods
Fuzzing
Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs
- either randomly or algorithmically - and dynamically invoking the code with those inputs.
Even with random inputs, it is often capable of generating unexpected results such as crashes,
memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases
that clearly indicate bugs, which helps developers to diagnose the issues.
Effectiveness = High
Demonstrative Examples
Example 1:
This code assumes a particular function will always be found at a particular address. It assigns a
pointer to that address and calls the function.
Example Language: C (Bad)
int (*pt2Function) (float, char, char)=0x08040000;
int result2 = (*pt2Function) (12, 'a', 'b');
// Here we can inject code to execute.
The same function may not always be found at the same memory address. This could lead to a
crash, or an attacker may alter the memory at the expected address, leading to arbitrary code
execution.
CWE Version 4.14
CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
CWE-758: Reliance on Undefined, Unspecified,
or Implementation-Defined Behavior 1584
Example 2:
The following function returns a stack address.
Example Language: C (Bad)
char* getName() {
char name[STR_MAX];
fillInName(name);
return name;
}
Observed Examples
Reference Description
CVE-2006-1902 Change in C compiler behavior causes resultant buffer overflows in programs
that depend on behaviors that were undefined in the C standard.
https://www.cve.org/CVERecord?id=CVE-2006-1902
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
MemberOf 1157 SEI CERT C Coding Standard - Guidelines 03.
Expressions (EXP)
1154 2455
MemberOf 1158 SEI CERT C Coding Standard - Guidelines 04. Integers
(INT)
1154 2456
MemberOf 1160 SEI CERT C Coding Standard - Guidelines 06. Arrays
(ARR)
1154 2457
MemberOf 1162 SEI CERT C Coding Standard - Guidelines 08. Memory
Management (MEM)
1154 2458
MemberOf 1163 SEI CERT C Coding Standard - Guidelines 09. Input
Output (FIO)
1154 2459
MemberOf 1167 SEI CERT C Coding Standard - Guidelines 12. Error
Handling (ERR)
1154 2461
MemberOf 1170 SEI CERT C Coding Standard - Guidelines 48.
Miscellaneous (MSC)
1154 2463
MemberOf 1306 CISQ Quality Measures - Reliability 1305 2483
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding ARR32-
C
CWE More
Abstract
Ensure size arguments for variable
length arrays are in a valid range
CERT C Secure Coding ERR34-
C
Imprecise Detect errors when converting a string
to a number
CERT C Secure Coding EXP30-C CWE More
Abstract
Do not depend on the order of
evaluation for side effects
CERT C Secure Coding EXP33-C CWE More
Abstract
Do not read uninitialized memory
CERT C Secure Coding FIO46-C CWE More
Abstract
Do not access a closed file
CERT C Secure Coding INT34-C CWE More
Abstract
Do not shift an expression by a
negative number of bits or by greater
CWE Version 4.14
CWE-759: Use of a One-Way Hash without a Salt
CWE-759: Use of a One-Way Hash without a Salt