Insufficient Resource Pool
Weakness ID: 410 (Weakness Base)Status: Incomplete
+ Description

Description Summary

The software's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Extended Description

Frequently the consequence is a "flood" of connection or sessions.

+ Time of Introduction
  • Architecture and Design
  • Implementation
  • Operation
+ Applicable Platforms

Languages

All

+ Common Consequences
ScopeEffect
Availability
Integrity

Floods often cause a crash or other problem besides denial of the resource itself; these are likely examples of *other* vulnerabilities, not an insufficient resource pool.

+ Demonstrative Examples

Example 1

In the following snippet from a Tomcat configuration file, a JDBC connection pool is defined with a maximum of 5 simultaneous connections (with a 60 second timeout). In this case, it may be trivial for an attacker to instigate a denial of service (DoS) by using up all of the available connections in the pool.

(Bad Code)
Example Language: XML 
<Resource name="jdbc/exampledb"
auth="Container"
type="javax.sql.DataSource"
removeAbandoned="true"
removeAbandonedTimeout="30"
maxActive="5"
maxIdle="5"
maxWait="60000"
username="testuser"
password="testpass"
driverClassName="com.mysql.jdbc.Driver"
url="jdbc:mysql://localhost/exampledb"/>
+ Observed Examples
ReferenceDescription
CVE-1999-1363Large number of locks on file exhausts the pool and causes crash.
CVE-2001-1340Product supports only one connection and does not disconnect a user who does not provide credentials.
CVE-2002-0406Large number of connections without providing credentials allows connection exhaustion.
+ Potential Mitigations

Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.

Consider implementing a velocity check mechanism which would detect abusive behavior.

Consider load balancing as an option to handle heavy loads.

Make sure that resource handles are properly closed when no longer needed.

Find the resouce intensive operations in your code and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).

+ Other Notes

"Large" is relative to the size of the resource pool, which could be very small. See examples.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory399Resource Management Errors
Development Concepts (primary)699
ChildOfWeakness ClassWeakness Class664Improper Control of a Resource Through its Lifetime
Research Concepts (primary)1000
ChildOfCategoryCategory730OWASP Top Ten 2004 Category A9 - Denial of Service
Weaknesses in OWASP Top Ten (2004) (primary)711
CanPrecedeWeakness BaseWeakness Base400Uncontrolled Resource Consumption ('Resource Exhaustion')
Development Concepts699
Research Concepts1000
CanAlsoBeWeakness BaseWeakness Base412Unrestricted Externally Accessible Lock
Research Concepts1000
+ Functional Areas
  • Non-specific
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERInsufficient Resource Pool
OWASP Top Ten 2004A9CWE More SpecificDenial of Service
+ References
[REF-11] M. Howard and D. LeBlanc. "Writing Secure Code". Chapter 17, "Protecting Against Denial of Service Attacks" Page 517. 2nd Edition. Microsoft. 2002.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Sean EidemillerCigitalExternal
added/updated demonstrative examples
2008-07-01Eric DalciCigitalExternal
updated Potential Mitigations, Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Common Consequences, Relationships, Other Notes, Taxonomy Mappings
2008-10-14CWE Content TeamMITREInternal
updated Description, Relationships
2009-07-27CWE Content TeamMITREInternal
updated Demonstrative Examples
2009-10-29CWE Content TeamMITREInternal
updated Common Consequences
Back to top