576
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Parameter Problems
Related Attack Patterns
CAPEC-ID Attack Pattern Name
39 Manipulating Opaque Client-based Data Tokens
CWE-234: Failure to Handle Missing Parameter
Weakness ID : 234
Structure : Simple
Abstraction : Variant
Description
If too few arguments are sent to a function, the function will still pop the expected number of
arguments from the stack. Potentially, a variable number of arguments could be exhausted in a
function as well.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 233 Improper Handling of Parameters 574
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Access Control
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
There is the potential for arbitrary code execution with
privileges of the vulnerable program if function parameter
list is exhausted.
Availability DoS: Crash, Exit, or Restart
Potentially a program could fail if it needs more arguments
then are available.
Potential Mitigations
Phase: Build and Compilation
This issue can be simply combated with the use of proper build process.
Phase: Implementation
Forward declare all functions. This is the recommended solution. Properly forward declaration of
all used functions will result in a compiler error if too few arguments are sent to a function.
CWE Version 4.14
CWE-234: Failure to Handle Missing Parameter
CWE-234: Failure to Handle Missing Parameter