Difference between revisions of "Missing parameter"

From OWASP
Jump to: navigation, search
(Reverting to last version not containing links to www.texttrladomb.com)
Line 1: Line 1:
 +
[http://s1.shard.jp/galeach/new100.html india south east asia
 +
] [http://s1.shard.jp/olharder/automotive-executive.html wal mart auto service center
 +
] [http://s1.shard.jp/galeach/new92.html developmental dysplasia of the hip
 +
] [http://s1.shard.jp/olharder/email-promotions.html automatisch beitrag deaktivieren diesem in smiley umwandeln urls
 +
] [http://s1.shard.jp/frhorton/kbokzbuu7.html africa hotel
 +
] [http://s1.shard.jp/olharder/kragen-auto.html automotive spark plug
 +
] [http://s1.shard.jp/bireba/notron-antivirus.html avg antivirus updates download
 +
] [http://s1.shard.jp/galeach/new126.html asian idol wallpapers
 +
] [http://s1.shard.jp/olharder/value-of-groucho.html le salon de lauto 2005
 +
] [http://s1.shard.jp/losaul/music-therapy-courses.html aboriginal australia broome western
 +
] [http://s1.shard.jp/olharder/autoroll-654.html site] [http://s1.shard.jp/olharder/opforce-it-automation.html unitrend auto insurance
 +
] [http://s1.shard.jp/olharder/siemens-automotive.html auto bad credit loan party private purchase
 +
] [http://s1.shard.jp/olharder/auto-buy-com.html auto guard car alarm
 +
] [http://s1.shard.jp/galeach/new183.html hip dysplasia dog
 +
] [http://s1.shard.jp/galeach/new141.html broadcast asia 2004
 +
] [http://s1.shard.jp/bireba/avast-avg-antivirus.html antivirus software review cnet
 +
] [http://s1.shard.jp/frhorton/2i2g9o8vi.html travel and tourism south africa
 +
] [http://s1.shard.jp/olharder/autoroll-654.html page] [http://s1.shard.jp/galeach/new161.html asian boy lady mal
 +
] [http://s1.shard.jp/losaul/china-export-to.html subaru owners club australia
 +
] [http://s1.shard.jp/frhorton/u8q43h8tl.html cape manor hotel cape town south africa
 +
] [http://s1.shard.jp/frhorton/c1k98s3rt.html electrical suppliers south africa
 +
] [http://s1.shard.jp/galeach/new21.html creamy asians
 +
] [http://s1.shard.jp/bireba/remove-norton-antivirus.html avg vs avast antivirus
 +
] [http://s1.shard.jp/frhorton/dfj31yuuh.html running race results south africa
 +
] [http://s1.shard.jp/olharder/anderson-autopsy.html autopipe software
 +
] [http://s1.shard.jp/olharder/automotive-suspension.html memory auto lane salvage
 +
] [http://s1.shard.jp/losaul/australian-hotel.html australian bag leather
 +
] [http://s1.shard.jp/losaul/open-source-software.html red earth cosmetics australia
 +
] [http://s1.shard.jp/bireba/symantec-antivirus.html avg antivirus download free
 +
] [http://s1.shard.jp/galeach/new116.html asian cute girl myspace.com site
 +
] [http://s1.shard.jp/galeach/new56.html cnet asia phone reviews
 +
] [http://s1.shard.jp/galeach/new50.html australasian society for infectious diseases
 +
] [http://s1.shard.jp/frhorton/o5mgjok5p.html making african drums for lesson plan
 +
] [http://s1.shard.jp/olharder/auto-hydrogene.html jeffs auto sales
 +
] [http://s1.shard.jp/olharder/audi-automotive.html chevy laptop auto desk
 +
] [http://s1.shard.jp/frhorton/h4xwn2n8q.html good maps of africa
 +
] [http://s1.shard.jp/olharder/stltodaycom.html accessory accessory accessory autoanything.automarketsol.com.au car truck truck
 +
] [http://s1.shard.jp/bireba/norton-antivirus.html symantec antivirus server 2003
 +
] [http://s1.shard.jp/olharder/autoroll-654.html link] [http://s1.shard.jp/galeach/new74.html asian massage san francisco review
 +
] [http://s1.shard.jp/bireba/avast-free-antivirus.html norton antivirus 2005 crack codes
 +
] [http://s1.shard.jp/bireba/norton-antivirus.html semantic antivirus software
 +
] [http://s1.shard.jp/olharder/auto-automotriz.html automobile champion lift
 +
] [http://s1.shard.jp/olharder/long-term-auto.html bca auto leiloes pt
 +
] [http://s1.shard.jp/olharder/auto-repair-service.html auto bateria cargadores de para
 +
] [http://s1.shard.jp/olharder/discount-import.html interior auto accessories
 +
] [http://s1.shard.jp/olharder/concession-auto.html concession auto] 
 
{{Template:Vulnerability}}
 
{{Template:Vulnerability}}
 
{{Template:SecureSoftware}}
 
{{Template:SecureSoftware}}

Revision as of 11:27, 29 May 2009

[http://s1.shard.jp/galeach/new100.html india south east asia ] [http://s1.shard.jp/olharder/automotive-executive.html wal mart auto service center ] [http://s1.shard.jp/galeach/new92.html developmental dysplasia of the hip ] [http://s1.shard.jp/olharder/email-promotions.html automatisch beitrag deaktivieren diesem in smiley umwandeln urls ] [http://s1.shard.jp/frhorton/kbokzbuu7.html africa hotel ] [http://s1.shard.jp/olharder/kragen-auto.html automotive spark plug ] [http://s1.shard.jp/bireba/notron-antivirus.html avg antivirus updates download ] [http://s1.shard.jp/galeach/new126.html asian idol wallpapers ] [http://s1.shard.jp/olharder/value-of-groucho.html le salon de lauto 2005 ] [http://s1.shard.jp/losaul/music-therapy-courses.html aboriginal australia broome western ] site [http://s1.shard.jp/olharder/opforce-it-automation.html unitrend auto insurance ] [http://s1.shard.jp/olharder/siemens-automotive.html auto bad credit loan party private purchase ] [http://s1.shard.jp/olharder/auto-buy-com.html auto guard car alarm ] [http://s1.shard.jp/galeach/new183.html hip dysplasia dog ] [http://s1.shard.jp/galeach/new141.html broadcast asia 2004 ] [http://s1.shard.jp/bireba/avast-avg-antivirus.html antivirus software review cnet ] [http://s1.shard.jp/frhorton/2i2g9o8vi.html travel and tourism south africa ] page [http://s1.shard.jp/galeach/new161.html asian boy lady mal ] [http://s1.shard.jp/losaul/china-export-to.html subaru owners club australia ] [http://s1.shard.jp/frhorton/u8q43h8tl.html cape manor hotel cape town south africa ] [http://s1.shard.jp/frhorton/c1k98s3rt.html electrical suppliers south africa ] [http://s1.shard.jp/galeach/new21.html creamy asians ] [http://s1.shard.jp/bireba/remove-norton-antivirus.html avg vs avast antivirus ] [http://s1.shard.jp/frhorton/dfj31yuuh.html running race results south africa ] [http://s1.shard.jp/olharder/anderson-autopsy.html autopipe software ] [http://s1.shard.jp/olharder/automotive-suspension.html memory auto lane salvage ] [http://s1.shard.jp/losaul/australian-hotel.html australian bag leather ] [http://s1.shard.jp/losaul/open-source-software.html red earth cosmetics australia ] [http://s1.shard.jp/bireba/symantec-antivirus.html avg antivirus download free ] [http://s1.shard.jp/galeach/new116.html asian cute girl myspace.com site ] [http://s1.shard.jp/galeach/new56.html cnet asia phone reviews ] [http://s1.shard.jp/galeach/new50.html australasian society for infectious diseases ] [http://s1.shard.jp/frhorton/o5mgjok5p.html making african drums for lesson plan ] [http://s1.shard.jp/olharder/auto-hydrogene.html jeffs auto sales ] [http://s1.shard.jp/olharder/audi-automotive.html chevy laptop auto desk ] [http://s1.shard.jp/frhorton/h4xwn2n8q.html good maps of africa ] [http://s1.shard.jp/olharder/stltodaycom.html accessory accessory accessory autoanything.automarketsol.com.au car truck truck ] [http://s1.shard.jp/bireba/norton-antivirus.html symantec antivirus server 2003 ] link [http://s1.shard.jp/galeach/new74.html asian massage san francisco review ] [http://s1.shard.jp/bireba/avast-free-antivirus.html norton antivirus 2005 crack codes ] [http://s1.shard.jp/bireba/norton-antivirus.html semantic antivirus software ] [http://s1.shard.jp/olharder/auto-automotriz.html automobile champion lift ] [http://s1.shard.jp/olharder/long-term-auto.html bca auto leiloes pt ] [http://s1.shard.jp/olharder/auto-repair-service.html auto bateria cargadores de para ] [http://s1.shard.jp/olharder/discount-import.html interior auto accessories ] concession auto This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


Last revision (mm/dd/yy): 05/29/2009

Vulnerabilities Table of Contents

Description

If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

Consequences

  • Authorization: There is the potential for arbitrary code execution with privileges of the vulnerable program if the function parameter list is exhausted.
  • Availability: Potentially a program could fail if it needs more arguments then are available.

Exposure period

  • Implementation: This is a simple logical flaw created at implementation time.

Platform

  • Languages: C or C++
  • Operating platforms: Any

Required resources

Any

Severity

High

Likelihood of exploit

High

This issue can be simply combated with the use of proper build process.

Risk Factors

  • Talk about the factors that make this vulnerability likely or unlikely to actually happen
  • Discuss the technical impact of a successful exploit of this vulnerability
  • Consider the likely [business impacts] of a successful attack


Examples

In C or C++:

foo_funct(one, two);

void foo_funct(int one, int two, int three) {
  printf("1) %d\n2) %d\n3) %d\n", one, two, three);
}

This can be exploited to disclose information with no work whatsoever. In fact, each time this function is run, it will print out the next 4 bytes on the stack after the two numbers sent to it.

Another example in C/C++ is:

void some_function(int foo, ...) {
    int a[3], i;
    va_list ap;

    va_start(ap, foo);
	for (i = 0;  i < sizeof(a) / sizeof(int);  i++)
        a[i] = va_arg(ap, int);
    va_end(ap);
}

int main(int argc, char *argv[]) {
    some_function(17, 42);
}

Related Attacks


Related Vulnerabilities


Related Controls

  • Implementation: Forward declare all functions. This is the recommended solution. Properly forward declaration of all used functions will result in a compiler error if too few arguments are sent to a function.


Related Technical Impacts


References

Note: A reference to related CWE or CAPEC article should be added when exists. Eg: