CAPEC-10: Buffer Overflow via Environment Variables

Description

This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the adversary finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.

Severity :

High

Possibility :

High

Type :

Detailed

Relationships with other CAPECs

This table shows the other attack patterns and high level categories that are related to this attack pattern.

CAPEC-13: Subverting Environment Variable Values Subverting Environment Variable Values CAPEC-46: Overflow Variables and Tags Overflow Variables and Tags CAPEC-69: Target Programs with Elevated Privileges Target Programs with Elevated Privileges CAPEC-100: Overflow Buffers Overflow Buffers

Prerequisites

This table shows the other attack patterns and high level categories that are related to this attack pattern.

The application uses environment variables.
An environment variable exposed to the user is vulnerable to a buffer overflow.
The vulnerable environment variable uses untrusted data.
Tainted data used in the environment variables is not properly validated. For instance boundary checking is not done before copying the input data to a buffer.

Skills required

This table shows the other attack patterns and high level categories that are related to this attack pattern.

Low An attacker can simply overflow a buffer by inserting a long string into an attacker-modifiable injection vector. The result can be a DoS.
High Exploiting a buffer overflow to inject malicious code into the stack of a software system or even the heap can require a higher skill level.

Taxonomy mappings

Mappings to ATT&CK, OWASP and other frameworks.

OWASP Attacks | Buffer Overflow via Environment Variables

Related CWE

A Related Weakness relationship associates a weakness with this attack pattern. Each association implies a weakness that must exist for a given attack to be successful.

CWE-20: Improper Input Validation

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-99: Improper Control of Resource Identifiers ('Resource Injection')

CWE-118: Incorrect Access of Indexable Resource ('Range Error')

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-302: Authentication Bypass by Assumed-Immutable Data

CWE-680: Integer Overflow to Buffer Overflow

CWE-697: Incorrect Comparison

CWE-733: Compiler Optimization Removal or Modification of Security-critical Code

Visit http://capec.mitre.org/ for more details.