474
tester to record and modify an active session. Specifically, manual static analysis is useful for
evaluating the correctness of allocation calculations. This can be useful for detecting overflow
conditions (CWE-190) or similar weaknesses that might have serious security impacts on the
program.
Effectiveness = High
These may be more effective than strictly automated techniques. This is especially the case with
weaknesses that are related to design and business rules.
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary
Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness = High
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Fuzz Tester Framework-based Fuzzer
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Manual Source Code Review (not inspections)
Effectiveness = SOAR Partial
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
Effectiveness = High
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE
1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
Phase: Requirements
Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be
identified simply, and require strict conformance to the protocol.
Phase: Requirements
Strategy = Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this
weakness easier to avoid. If possible, choose a language or compiler that performs automatic
bounds checking.
Phase: Architecture and Design
Strategy = Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid. Use libraries or frameworks that make it
easier to handle numbers without unexpected consequences. Examples include safe integer
handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
CWE Version 4.14
CWE-190: Integer Overflow or Wraparound
CWE-190: Integer Overflow or Wraparound