Weakness (CWE)
CWE-121: Stack-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the stack.
How to prevent it (5 mitigations)
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Source: MITRE CWE-121
2,638 results · Clear filters · Feed
-
High 7.0
Potential Leakage of Nintendo Switch System Information Through a Proximity-Based Remote Attack
A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an attacker within wireless range to execute arbitrary code using return-oriented programming (ROP) through crafted network traffic. This issu…
-
High 8.5
Authenticated Stack-Based Buffer Overflow in RE210 AC750 Configuration Import
A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a cr…
-
High 7.8
Microsoft Graphics Component Elevation of Privilege Vulnerability
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 7.8
Microsoft Excel Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
-
High 8.8
DirectWrite Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Access Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
High 8.1
Windows DHCP Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows Device Association Service Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges over a network.
-
High 8.1
Windows DHCP Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows MIDI Service Module Elevation of Privileges Vulnerability
Stack-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows USB Driver Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Graphics Component Elevation of Privilege Vulnerability
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows Win32k Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows NTFS Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Windows NTFS Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.5
Microsoft SQL Server Remote Code Execution Vulnerability
Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Graphics Component Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Storage Management Provider Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows Win32k Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Windows Win32k Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Windows NTFS Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code over a network.
-
High 8.0
Windows DHCP Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network.
-
High 7.8
Windows Broker Infrastructure Service Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Broker Infrastructure Service allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows Fast FAT Driver Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Fast FAT Driver allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
-
High 8.7
CommServe Stack-based Buffer Overflow
CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
-
High 8.0
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
-
High 8.8
PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend
PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (tls_cert_get_info() in …
-
High 8.8
PJSIP: Stack overflow parsing SDP a=crypto attributes
PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport…
-
High 8.8
PJSIP: Stack overflow handling Service-Route headers in a registration response
PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing Service-Route headers in a registration response (update_service_route() in pjsua_acc.c). This affe…
-
High 7.7
Stack-based buffer overflow in TP-Link Archer AX55 v4
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution …
-
High 7.8
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-leve…