Client-side Injection-induced Buffer Overflow
Attack Pattern ID: 14 (Detailed Attack Pattern Completeness: Complete)Typical Severity: HighStatus: Draft
+ Description


This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.

Attack Execution Flow

  1. The attacker creates a custom hostile service

  2. The attacker acquires information about the kind of client attaching to her hostile service to determine if it contains an exploitable buffer overflow vulnerability.

  3. The attacker intentionally feeds malicious data to the client to exploit the buffer overflow vulnerability that she has uncovered.

  4. The attacker leverages the exploit to execute arbitrary code or to cause a denial of service.

+ Attack Prerequisites

The targeted client software communicates with an external server.

The targeted client software has a buffer oveflow vulnerability.

+ Typical Likelihood of Exploit

Likelihood: Medium

+ Methods of Attack
  • API Abuse
  • Injection
+ Examples-Instances


Authors often use <EMBED> tags in HTML documents. For example

<EMBED TYPE="audio/midi" SRC="../../path/file.mid.html" AUTOSTART="true">

If an attacker supplies an overly long path in the SRC= directive, the mshtml.dll component will suffer a buffer overflow. This is a standard example of content in a Web page being directed to exploit a faulty module in the system. There are potentially thousands of different ways data can propagate into a given system, thus these kinds of attacks will continue to be found in the wild.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Low

To achieve a denial of service, an attacker can simply overflow a buffer by inserting a long string into an attacker-modifiable injection vector.

High : Exploiting a buffer overflow to inject malicious code into the stack of a software system or even the heap requires a more in-depth knowledge and higher skill level.

+ Probing Techniques

The server may look like a valid server, but in reality it may be a hostile server aimed at fooling the client software. For instance the server can use honey pots and get the client to download malicious code.

Once engaged with the client, the hostile server may attempt to scan the client's host for open ports and potential vulnerabilities in the client software.

The hostile server may also attempt to install and run malicious code on the client software. That malicious code can be used to scan the client software for buffer overflow.

+ Indicators-Warnings of Attack

An example of indicator is when the client software crashes after executing code downloaded from a hostile server.

+ Solutions and Mitigations

The client software should not install untrusted code from a non authenticated server.

The client software should have the latest patches and should be audited for vulnerabilities before being used to communicate with potentially hostile servers.

Perform input validation for length of buffer inputs.

Use a language or compiler that performs automatic bounds checking.

Use an abstraction library to abstract away risky APIs. Not a complete solution.

Compiler-based canary mechanisms such as StackGuard, ProPolice and the Microsoft Visual Studio /GS flag. Unless this provides automatic bounds checking, it is not a complete solution.

Ensure all buffer uses are consistently bounds-checked.

Use OS-level preventative functionality. Not a complete solution.

+ Attack Motivation-Consequences
  • Denial of Service
  • Run Arbitrary Code
+ Payload

Attacker-supplied data potentially containing malicious code.

+ Activation Zone

When the function returns control to the main program, it jumps to the return address portion of the stack frame. Unfortunately that return address may have been overwritten by the overflowed buffer and the address may contain a call to a privileged command or to malicious code.

+ Payload Activation Impact

The most common are remote code execution or denial of service.

+ Related Weaknesses
CWE-IDWeakness NameWeakness Relationship Type
120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')Targeted
353Failure to Add Integrity Check ValueTargeted
118Improper Access of Indexable Resource ('Range Error')Targeted
119Failure to Constrain Operations within the Bounds of a Memory BufferTargeted
74Failure to Sanitize Data into a Different Plane ('Injection')Targeted
20Improper Input ValidationTargeted
680Integer Overflow to Buffer OverflowTargeted
697Insufficient ComparisonTargeted
713OWASP Top Ten 2007 Category A2 - Injection FlawsTargeted
+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
ChildOfAttack PatternAttack Pattern8Buffer Overflow in an API Call 
Mechanism of Attack1000
ChildOfAttack PatternAttack Pattern100Overflow Buffers 
Mechanism of Attack (primary)1000
CanFollowAttack PatternAttack Pattern13Subverting Environment Variable Values 
Mechanism of Attack1000
+ Related Security Principles
  • Reluctance to Trust

  • Defense in Depth

+ Purposes
  • Penetration
+ CIA Impact
Confidentiality Impact: HighIntegrity Impact: HighAvailability Impact: High
+ Technical Context
Architectural Paradigms
+ References
G. Hoglund and G. McGraw. "Exploiting Software: How to Break Code". Addison-Wesley. February 2004.

CWE - Buffer Errors

+ Content History
G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.Cigital, Inc2007-03-01
Eric DalciCigital, Inc2007-02-13Fleshed out content to CAPEC schema from the original descriptions in "Exploiting Software"
Sean BarnumCigital, Inc2007-03-05Review and revise
Richard StruseVOXEM, Inc2007-03-26Review and feedback leading to changes in Related Attack Patterns
Sean BarnumCigital, Inc2007-04-13Modified pattern content according to review and feedback