1106
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 707 Improper Neutralization 1546
PeerOf 464 Addition of Data Structure Sentinel 1107
PeerOf 170 Improper Null Termination 428
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 137 Data Neutralization Issues 2311
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability
Other
Other
Generally this error will cause the data structure to not
work properly.
Authorization
Other
Other
If a control character, such as NULL is removed, one may
cause resource access control problems.
Potential Mitigations
Phase: Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Phase: Build and Compilation
Strategy = Compilation or Build Hardening
Run or compile the software using features or extensions that automatically provide a protection
mechanism that mitigates or eliminates buffer overflows. For example, certain compilers
and extensions provide automatic buffer overflow detection mechanisms that are built into
the compiled code. Examples include the Microsoft Visual Studio /GS flag, Fedora/Red Hat
FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice.
Effectiveness = Defense in Depth
This is not necessarily a complete solution, since these mechanisms can only detect certain
types of overflows. In addition, an attack could still cause a denial of service, since the typical
response is to exit the application.
Phase: Operation
Use OS-level preventative functionality. Not a complete solution.
Demonstrative Examples
Example 1:
This example creates a null terminated string and prints it contents.
CWE Version 4.14
CWE-464: Addition of Data Structure Sentinel
CWE-464: Addition of Data Structure Sentinel