1845
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability DoS: Amplification
DoS: Crash, Exit, or Restart
DoS: Resource Consumption (CPU)
DoS: Resource Consumption (Memory)
DoS: Resource Consumption (Other)
System resources can be quickly consumed leading
to poor application performance or system crash. This
may affect network performance and could be used to
attack other systems and applications relying on network
performance.
Potential Mitigations
Phase: Architecture and Design
Strategy = Separation of Privilege
An application must make network resources available to a client commensurate with the client's
access level.
Phase: Policy
Define a clear policy for network resource allocation and consumption.
Phase: Implementation
An application must, at all times, keep track of network resources and meter their usage
appropriately.
Demonstrative Examples
Example 1:
This code listens on a port for DNS requests and sends the result to the requesting address.
Example Language: Python (Bad)
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.bind( (UDP_IP,UDP_PORT) )
while true:
data = sock.recvfrom(1024)
if not data:
break
(requestIP, nameToResolve) = parseUDPpacket(data)
record = resolveName(nameToResolve)
sendResponse(requestIP,record)
This code sends a DNS record to a requesting IP address. UDP allows the source IP address to be
easily changed ('spoofed'), thus allowing an attacker to redirect responses to a target, which may
be then be overwhelmed by the network traffic.
Observed Examples
Reference Description
CVE-1999-0513 Classic "Smurf" attack, using spoofed ICMP packets to broadcast addresses.
CWE Version 4.14
CWE-407: Inefficient Algorithmic Complexity
CWE-407: Inefficient Algorithmic Complexity