313
CAPEC-ID Attack Pattern Name
44 Overflow Binary Resource File
45 Buffer Overflow via Symbolic Links
46 Overflow Variables and Tags
47 Buffer Overflow via Parameter Expansion
67 String Format Overflow in syslog()
92 Forced Integer Overflow
100 Overflow Buffers
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-56]Microsoft. "Using the Strsafe.h Functions". < https://learn.microsoft.com/en-us/windows/
win32/menurc/strsafe-ovw?redirectedfrom=MSDN >.2023-04-07.
[REF-57]Matt Messier and John Viega. "Safe C String Library v1.0.3". < http://www.gnu-darwin.org/
www001/ports-1.5a-CURRENT/devel/safestr/work/safestr-1.0.3/doc/safestr.html >.2023-04-07.
[REF-58]Michael Howard. "Address Space Layout Randomization in Windows Vista". < https://
learn.microsoft.com/en-us/archive/blogs/michael_howard/address-space-layout-randomization-inwindows-
vista >.2023-04-07.
[REF-59]Arjan van de Ven. "Limiting buffer overflows with ExecShield". < https://archive.is/saAFo
>.2023-04-07.
[REF-60]"PaX". < https://en.wikipedia.org/wiki/Executable_space_protection#PaX >.2023-04-07.
[REF-74]Jason Lam. "Top 25 Series - Rank 3 - Classic Buffer Overflow". 2010 March 2. SANS
Software Security Institute. < http://software-security.sans.org/blog/2010/03/02/top-25-seriesrank-
3-classic-buffer-overflow/ >.
[REF-61]Microsoft. "Understanding DEP as a mitigation technology part 1". < https://
msrc.microsoft.com/blog/2009/06/understanding-dep-as-a-mitigation-technology-part-1/
>.2023-04-07.
[REF-76]Sean Barnum and Michael Gegick. "Least Privilege". 2005 September 4. < https://
web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/least-privilege >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-64]Grant Murphy. "Position Independent Executables (PIE)". 2012 November 8. Red Hat. <
https://www.redhat.com/en/blog/position-independent-executables-pie >.2023-04-07.
[REF-961]Object Management Group (OMG). "Automated Source Code Reliability Measure
(ASCRM)". 2016 January. < http://www.omg.org/spec/ASCRM/1.0/ >.
[REF-962]Object Management Group (OMG). "Automated Source Code Security Measure
(ASCSM)". 2016 January. < http://www.omg.org/spec/ASCSM/1.0/ >.
[REF-1332]John Richard Moser. "Prelink and address space randomization". 2006 July 5. < https://
lwn.net/Articles/190139/ >.2023-04-26.
CWE Version 4.14
CWE-121: Stack-based Buffer Overflow
CWE-121: Stack-based Buffer Overflow