Improper Null Termination

Opis

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

Null termination errors frequently occur in two different ways. An off-by-one error could cause a null to be written out of bounds, leading to an overflow. Or, a program could use a strncpy() function call incorrectly, which prevents a null terminator from being added at all. Other scenarios are possible.

Skutki

• Confidentiality, Integrity, Availability

  Read Memory; Execute Unauthorized Code or Commands

  The case of an omitted null character is the most dangerous of the possible issues. This will almost certainly result in information disclosure, and possibly a buffer overflow condition, which may be exploited to execute arbitrary code.

• Confidentiality, Integrity, Availability

  DoS: Crash, Exit, or Restart; Read Memory; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)

  If a null character is omitted from a string, then most string-copying functions will read data until they locate a null character, even outside of the intended boundaries of the string. This could: cause a crash due to a segmentation fault cause sensitive adjacent memory to be copied and sent to an outsider trigger a buffer overflow when the copy is being written to a fixed-size buffer.

• Integrity, Availability

  Modify Memory; DoS: Crash, Exit, or Restart

  Misplaced null characters may result in any number of security problems. The biggest issue is a subset of buffer overflow, and write-what-where conditions, where data corruption occurs from the writing of a null character over valid data, or even instructions. A randomly placed null character may put the system into an undefined state, and therefore make it prone to crashing. A misplaced null character may corrupt other data in memory.

• Integrity, Confidentiality, Availability, Access Control, Other

  Alter Execution Logic; Execute Unauthorized Code or Commands

  Should the null character corrupt the process flow, or affect a flag controlling access, it may lead to logical errors which allow for the execution of arbitrary code.

Zapobieganie

• Requirements

  Use a language that is not susceptible to these issues. However, be careful of null byte interaction errors (CWE-626) with lower-level constructs that may be written in a language that is susceptible.

• Implementation

  Ensure that all string functions used are understood fully as to how they append null characters. Also, be wary of off-by-one errors when appending nulls to the end of strings.

• Implementation

  If performance constraints permit, special code can be added that validates null-termination of string buffers, this is a rather naive and error-prone solution.

• Implementation

  Switch to bounded string manipulation functions. Inspect buffer lengths involved in the buffer overrun trace reported with the defect.

• Implementation

  Add code that fills buffers with nulls (however, the length of buffers still needs to be inspected, to ensure that the non null-terminated string is not written at the physical end of the buffer).

Przykłady podatności

• CVE-2000-0312 Attacker does not null-terminate argv[] when invoking another program.
• CVE-2003-0777 Interrupted step causes resultant lack of null termination.
• CVE-2004-1072 Fault causes resultant lack of null termination, leading to buffer expansion.
• CVE-2001-1389 Multiple vulnerabilities related to improper null termination.
• CVE-2003-0143 Product does not null terminate a message buffer after snprintf-like call, leading to overflow.
• CVE-2009-2523 Chain: product does not handle when an input string is not NULL terminated (CWE-170), leading to buffer over-read (CWE-125) or heap-based buffer overflow (CWE-122).

Słabość nadrzędna

• CWE-707 Improper Neutralization
• CWE-20 Improper Input Validation

Może prowadzić do

• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CWE-126 Buffer Over-read

Może też być

• CWE-147 Improper Neutralization of Input Terminators

Pokrewna

• CWE-464 Addition of Data Structure Sentinel
• CWE-463 Deletion of Data Structure Sentinel

Kiedy powstaje

• Implementation

Dotyczy

C, C++

Uwagi

Factors: this is usually resultant from other weaknesses such as off-by-one errors, but it can be primary to boundary condition violations such as buffer overflows. In buffer overflows, it can act as an expander for assumed-immutable data.

Overlaps missing input terminator.

Conceptually, this does not just apply to the C language; any language or representation that involves a terminator could have this type of problem.

As currently described, this entry is more like a category than a weakness.