Improper Handling of Highly Compressed Data (Data Amplification)

Opis

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

Skutki

• Availability

  DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)

  System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.

Przykłady podatności

• CVE-2009-1955 XML bomb in web server module
• CVE-2003-1564 Parsing library allows XML bomb

Słabość nadrzędna

• CWE-405 Asymmetric Resource Consumption (Amplification)

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific