CWE - CWE-680: Integer Overflow to Buffer Overflow (2.10)

Compound Element ID: 680

Abstraction: Base
Structure: Chain

Status: Draft

Presentation Filter:

Description

Description Summary

The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

Applicable Platforms

Languages

All

Common Consequences

Scope	Effect
Integrity Availability Confidentiality	Technical Impact: Modify memory; DoS: crash / exit / restart; Execute unauthorized code or commands

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to	Named Chain(s) this relationship pertains to
StartsWith	Weakness Base	190	Integer Overflow or Wraparound	Named Chains709	Integer Overflow to Buffer Overflow680
ChildOf	Weakness Class	20	Improper Input Validation	Research Concepts (primary)1000
ChildOf	Weakness Class	119	Improper Restriction of Operations within the Bounds of a Memory Buffer	Development Concepts (primary)699

Relevant Properties

Validity

Related Attack Patterns

CAPEC-ID	Attack Pattern Name	(CAPEC Version: 2.9)
CAPEC-10	Buffer Overflow via Environment Variables
CAPEC-100	Overflow Buffers
CAPEC-14	Client-side Injection-induced Buffer Overflow
CAPEC-24	Filter Failure through Buffer Overflow
CAPEC-45	Buffer Overflow via Symbolic Links
CAPEC-46	Overflow Variables and Tags
CAPEC-47	Buffer Overflow via Parameter Expansion
CAPEC-67	String Format Overflow in syslog()
CAPEC-8	Buffer Overflow in an API Call
CAPEC-9	Buffer Overflow in Local Command-Line Utilities
CAPEC-92	Forced Integer Overflow

Content History

Modifications
Modification Date	Modifier	Organization	Source
2008-07-01	Eric Dalci	Cigital	External
2008-07-01	updated Time_of_Introduction
2008-09-08	CWE Content Team	MITRE	Internal
2008-09-08	updated Relationships
2009-03-10	CWE Content Team	MITRE	Internal
2009-03-10	updated Related_Attack_Patterns
2011-06-01	CWE Content Team	MITRE	Internal
2011-06-01	updated Common_Consequences
2017-01-19	CWE Content Team	MITRE	Internal
2017-01-19	updated Relationships


	Use of the Common Weakness Enumeration and the associated references from this website are subject to the Terms of Use. For more information, please email [email protected]. CWE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 2006-2017, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.	Privacy policy Terms of use Contact us

Common Weakness Enumeration

CWE-680: Integer Overflow to Buffer Overflow