850
printf("Incorrect Password!\n");
return(0)
}
printf("Entering Diagnostic Mode...\n");
return(1);
}
Example Language: Java (Bad)
int VerifyAdmin(String password) {
if (!password.equals("Mew!")) {
return(0)
}
//Diagnostic Mode
return(1);
}
Every instance of this program can be placed into diagnostic mode with the same password. Even
worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to
change that password or disable this "functionality."
Example 2:
This code assumes a particular function will always be found at a particular address. It assigns a
pointer to that address and calls the function.
Example Language: C (Bad)
int (*pt2Function) (float, char, char)=0x08040000;
int result2 = (*pt2Function) (12, 'a', 'b');
// Here we can inject code to execute.
The same function may not always be found at the same memory address. This could lead to a
crash, or an attacker may alter the memory at the expected address, leading to arbitrary code
execution.
Observed Examples
Reference Description
CVE-2002-0980 Component for web browser writes an error message to a known location,
which can then be referenced by attackers to process HTML/script in a less
restrictive context
https://www.cve.org/CVERecord?id=CVE-2002-0980
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 905 SFP Primary Cluster: Predictability 888 2388
MemberOf 1414 Comprehensive Categorization: Randomness 1400 2543
Notes
Relationship
overlaps default configuration.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Static Value in Unpredictable Context
CWE Version 4.14
CWE-345: Insufficient Verification of Data Authenticity
CWE-345: Insufficient Verification of Data Authenticity