1113
In AuthenticateUser(), because sizeof() is applied to a parameter with an array type, the sizeof()
call might return 4 on many modern architectures. As a result, the strncmp() call only checks the
first four characters of the input password, resulting in a partial comparison (CWE-187), leading to
improper authentication (CWE-287).
Because of the partial comparison, any of these passwords would still cause authentication to
succeed for the "admin" user:
Example Language: (Attack)
pass5
passABCDEFGH
passWORD
Because only 4 characters are checked, this significantly reduces the search space for an attacker,
making brute force attacks more feasible.
The same problem also applies to the username, so values such as "adminXYZ" and
"administrator" will succeed for the username.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 737 CERT C Secure Coding Standard (2008) Chapter 4 -
Expressions (EXP)
734 2341
MemberOf 740 CERT C Secure Coding Standard (2008) Chapter 7 -
Arrays (ARR)
734 2344
MemberOf 874 CERT C++ Secure Coding Section 06 - Arrays and the
STL (ARR)
868 2375
MemberOf 884 CWE Cross-section 884 2567
MemberOf 974 SFP Secondary Cluster: Incorrect Buffer Length
Computation
888 2406
MemberOf 1162 SEI CERT C Coding Standard - Guidelines 08. Memory
Management (MEM)
1154 2458
MemberOf 1408 Comprehensive Categorization: Incorrect Calculation 1400 2534
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Use of sizeof() on a pointer type
CERT C Secure Coding ARR01-
C
Do not apply the sizeof operator to a
pointer when taking the size of an array
CERT C Secure Coding MEM35-
C
CWE More
Abstract
Allocate sufficient memory for an object
Software Fault Patterns SFP10 Incorrect Buffer Length Computation
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-442]Robert Seacord. "EXP01-A. Do not take the sizeof a pointer to determine the size of a
type". < https://www.securecoding.cert.org/confluence/display/seccode/EXP01-A.+Do+not+take
+the+sizeof+a+pointer+to+determine+the+size+of+a+type >.
CWE Version 4.14
CWE-468: Incorrect Pointer Scaling
CWE-468: Incorrect Pointer Scaling