473
Nature Type ID Name Page
MemberOf 189 Numeric Errors 2312
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Availability DoS: Crash, Exit, or Restart
DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
DoS: Instability
This weakness will generally lead to undefined behavior
and therefore crashes. In the case of overflows involving
loop index variables, the likelihood of infinite loops is also
high.
Integrity Modify Memory
If the value in question is important to data (as opposed
to flow), simple data corruption has occurred. Also, if the
wrap around results in other conditions such as buffer
overflows, further memory corruption may occur.
Confidentiality
Availability
Access Control
Execute Unauthorized Code or Commands
Bypass Protection Mechanism
This weakness can sometimes trigger buffer overflows
which can be used to execute arbitrary code. This is
usually outside the scope of a program's implicit security
policy.
Detection Methods
Automated Static Analysis
This weakness can often be detected using automated static analysis tools. Many modern tools
use data flow analysis or constraint-based techniques to minimize the number of false positives.
Effectiveness = High
Black Box
Sometimes, evidence of this weakness can be detected using dynamic tools and techniques that
interact with the product using large test suites with many diverse inputs, such as fuzz testing
(fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it
should not become unstable, crash, or generate incorrect results.
Effectiveness = Moderate
Without visibility into the code, black box methods may not be able to sufficiently distinguish this
weakness from others, requiring follow-up manual methods to diagnose the underlying problem.
Manual Analysis
This weakness can be detected using tools and techniques that require manual (human)
analysis, such as penetration testing, threat modeling, and interactive tools that allow the
CWE Version 4.14
CWE-190: Integer Overflow or Wraparound
CWE-190: Integer Overflow or Wraparound