Improper Handling of Length Parameter Inconsistency
Weakness ID: 130 (Weakness Base)Status: Incomplete
+ Description

Description Summary

The software parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Extended Description

If an attacker can manipulate the length parameter associated with an input such that it is inconsistent with the actual length of the input, this can be leveraged to cause the target application to behave in unexpected, and possibly, malicious ways. One of the possible motives for doing so is to pass in arbitrarily large input to the application. Another possible motivation is the modification of application state by including invalid data for subsequent properties of the application. Such weaknesses commonly lead to attacks such as buffer overflows and execution of arbitrary code.

+ Alternate Terms
length manipulation
length tampering
+ Time of Introduction
  • Architecture and Design
  • Implementation
+ Applicable Platforms

Languages

C: (Sometimes)

C++: (Sometimes)

All

+ Observed Examples
ReferenceDescription
CVE-2009-2299Web application firewall consumes excessive memory when an HTTP request contains a large Content-Length value but no POST data.
CVE-2001-0825
CVE-2001-1186
CVE-2001-0191
CVE-2003-0429
CVE-2000-0655
CVE-2004-0492
CVE-2004-0201
CVE-2003-0825can overlap zero-length issues
CVE-2004-0095
CVE-2004-0826
CVE-2004-0808
CVE-2002-1357
CVE-2004-0774
CVE-2004-0989
CVE-2004-0568
CVE-2003-0327
CVE-2003-0345
CVE-2004-0430
CVE-2005-0064
CVE-2004-0413leads to memory consumption, integer overflow, and heap overflow
CVE-2004-0940is effectively an accidental double increment of a counter that prevents a length check conditional from exiting a loop.
CVE-2002-1235length field of a request not verified
CVE-2005-3184buffer overflow by modifying a length value
SECUNIA:18747length field inconsistency crashes cell phone
+ Potential Mitigations

Do not let the user control the size of the buffer.

Validate that the length of the user-supplied data is consistent with the buffer size.

+ Weakness Ordinalities
OrdinalityDescription
Primary
(where the weakness exists independent of other weaknesses)
+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness Class119Failure to Constrain Operations within the Bounds of a Memory Buffer
Development Concepts (primary)699
ChildOfWeakness BaseWeakness Base240Improper Handling of Inconsistent Structural Elements
Research Concepts (primary)1000
CanPrecedeWeakness BaseWeakness Base805Buffer Access with Incorrect Length Value
Research Concepts1000
+ Relationship Notes

This probably overlaps other categories including zero-length issues.

+ Causal Nature

Implicit

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERLength Parameter Inconsistency
+ Related Attack Patterns
CAPEC-IDAttack Pattern Name
(CAPEC Version: 1.4)
47Buffer Overflow via Parameter Expansion
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Potential Mitigations, Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Applicable Platforms, Description, Name, Relationships, Observed Example, Relationship Notes, Taxonomy Mappings, Weakness Ordinalities
2009-03-10CWE Content TeamMITREInternal
updated Description, Name
2009-12-28CWE Content TeamMITREInternal
updated Observed Examples
Previous Entry Names
Change DatePrevious Entry Name
2008-09-09Length Parameter Inconsistency
2009-03-10Failure to Handle Length Parameter Inconsistency
Back to top