442
NetUserGetInfo(NULL, unicodeUser, 2, (LPBYTE *)&info);
}
This function incorrectly passes the size of unicodeUser in bytes instead of characters. The call
to MultiByteToWideChar() can therefore write up to (UNLEN+1)*sizeof(WCHAR) wide characters,
or (UNLEN+1)*sizeof(WCHAR)*sizeof(WCHAR) bytes, to the unicodeUser array, which has only
(UNLEN+1)*sizeof(WCHAR) bytes allocated.
If the username string contains more than UNLEN characters, the call to MultiByteToWideChar()
will overflow the buffer unicodeUser.
Observed Examples
Reference Description
CVE-2000-0884 Server allows remote attackers to read documents outside of the web root,
and possibly execute arbitrary commands, via malformed URLs that contain
Unicode encoded characters.
https://www.cve.org/CVERecord?id=CVE-2000-0884
CVE-2001-0709 Server allows a remote attacker to obtain source code of ASP files via a URL
encoded with Unicode.
https://www.cve.org/CVERecord?id=CVE-2001-0709
CVE-2001-0669 Overlaps interaction error.
https://www.cve.org/CVERecord?id=CVE-2001-0669
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 747 CERT C Secure Coding Standard (2008) Chapter 14 -
Miscellaneous (MSC)
734 2350
MemberOf 883 CERT C++ Secure Coding Section 49 - Miscellaneous
(MSC)
868 2381
MemberOf 992 SFP Secondary Cluster: Faulty Input Transformation 888 2416
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Unicode Encoding
CERT C Secure Coding MSC10-
C
Character Encoding - UTF8 Related
Issues
Related Attack Patterns
CAPEC-ID Attack Pattern Name
71 Using Unicode Encoding to Bypass Validation Logic
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-177: Improper Handling of URL Encoding (Hex Encoding)
Weakness ID : 177
Structure : Simple
Abstraction : Variant
CWE Version 4.14
CWE-177: Improper Handling of URL Encoding (Hex Encoding)
CWE-177: Improper Handling of URL Encoding (Hex Encoding)