308
This is not necessarily a complete solution, since these mechanisms only detect certain types of
overflows. In addition, the result is still a denial of service, since the typical response is to exit the
application.
Phase: Implementation
Consider adhering to the following rules when allocating and managing an application's memory:
Double check that your buffer is as large as you specify. When using functions that accept a
number of bytes to copy, such as strncpy(), be aware that if the destination buffer size is equal
to the source buffer size, it may not NULL-terminate the string. Check buffer boundaries if
accessing the buffer in a loop and make sure there is no danger of writing past the allocated
space. If necessary, truncate all input strings to a reasonable length before passing them to the
copy and concatenation functions.
Phase: Implementation
Strategy = Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use
a list of acceptable inputs that strictly conform to specifications. Reject any input that does not
strictly conform to specifications, or transform it into something that does. When performing
input validation, consider all potentially relevant properties, including length, type of input, the
full range of acceptable values, missing or extra inputs, syntax, consistency across related
fields, and conformance to business rules. As an example of business rule logic, "boat" may be
syntactically valid because it only contains alphanumeric characters, but it is not valid if the input
is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for
malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if
the code's environment changes. This can give attackers enough room to bypass the intended
validation. However, denylists can be useful for detecting potential attacks or determining which
inputs are so malformed that they should be rejected outright.
Phase: Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are
duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side
checks by modifying values after the checks have been performed, or by changing the client to
remove the client-side checks entirely. Then, these modified values would be submitted to the
server.
Phase: Operation
Phase: Build and Compilation
Strategy = Environment Hardening
Run or compile the software using features or extensions that randomly arrange the positions
of a program's executable and libraries in memory. Because this makes the addresses
unpredictable, it can prevent an attacker from reliably jumping to exploitable code. Examples
include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-
Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their
default memory addresses conflict with other modules, in a process known as "rebasing" (for
Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR
for libraries cannot be used in conjunction with prelink since it would require relocating the
libraries at run-time, defeating the whole purpose of prelinking. For more information on these
techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Effectiveness = Defense in Depth
These techniques do not provide a complete solution. For instance, exploits frequently use a bug
that discloses memory addresses in order to maximize reliability of code execution [REF-1337]. It
has also been shown that a side-channel attack can bypass ASLR [REF-1333]
Phase: Operation
CWE Version 4.14
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')