Weakness (CWE)
CWE-121: Stack-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the stack.
How to prevent it (5 mitigations)
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Source: MITRE CWE-121
728 results · Clear filters · Feed
-
Medium 5.1
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already f…
-
Medium 5.3
SourceCodester Student Record Management System View All Student Marks main stack-based overflow
A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as critical. Affected by this vulnerability is the function main of the component View All Student Marks. The manipulation leads to stack-based buffer overflo…
-
Medium 6.3
A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7…
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version …
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version …
-
Medium 6.7
Stack-based Buffer Overflow in Power Management IC
Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.
-
Medium 5.5
TP-Link WR740N V6 has a stack overflow vulnerability via the ssid parameter in /userRpm/popupSiteSurveyRpm.htm url.
-
Medium 5.7
D-Link COVR-2600R FW101b05 is vulnerable to Buffer Overflow. In the function sub_24E28, the HTTP_REFERER is obtained th…
-
Medium 6.8
Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service Vulnerabilities
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial…
-
Medium 6.8
Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service Vulnerabilities
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to cause an unexpected reload of an affected device, resulting in a denial…
-
Medium 6.5
Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability,…
-
Medium 6.5
Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability,…
-
Medium 6.5
Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability,…
-
Medium 6.5
Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities
A vulnerability in the web-based management interface of Cisco Small Business RV042, RV042G, RV320, and RV325 Routers could allow an authenticated, Administrator-level, remote attacker to execute arbitrary code as the root user. To exploit this vulnerability,…
-
Medium 6.5
TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow
A vulnerability was found in TP-LINK TL-WR841ND up to 20240920. It has been rated as critical. Affected by this issue is some unknown functionality of the file /userRpm/popupSiteSurveyRpm.htm. The manipulation of the argument ssid leads to stack-based buffer …
-
Medium 6.8
Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability
Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required …
-
Medium 6.3
BT: Unchecked user input in bap_broadcast_assistant
BT: Unchecked user input in bap_broadcast_assistant
-
Medium 6.7
A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could …
-
Medium 6.7
A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attack…
-
Medium 6.5
Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function.
-
Medium 6.5
Tenda FH451 v1.0.0.9 has a stack overflow vulnerability located in the RouteStatic function.
-
Medium 5.7
CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function.
-
Medium 5.7
Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function.
-
Medium 6.1
During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device …
-
Medium 5.4
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the foll…
-
Medium 6.3
Linksys WRT54G POST Parameter apply.cgi validate_services_port stack-based overflow
A vulnerability was found in Linksys WRT54G 4.21.5. It has been rated as critical. Affected by this issue is the function validate_services_port of the file /apply.cgi of the component POST Parameter Handler. The manipulation of the argument services_array le…
-
Medium 6.6
Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo.
-
Medium 6.6
Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv.
-
Medium 6.5
Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the functino formWrlExtraGet.
-
Medium 4.3
autMan v2.9.6 was discovered to contain an access control issue.
-
Medium 4.3
autMan v2.9.6 allows attackers to bypass authentication via a crafted web request.
-
Medium 6.5
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the qos parameter in the fromqossetting fun…
-
Medium 6.5
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ProtForm functi…
-
Medium 6.5
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromVirtualSer fu…
-
Medium 6.5
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSetlpBind functi…
-
Medium 6.5
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter…
-
Medium 6.5
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the Go parameter in the fromSafeUrlFilter func…
-
Medium 6.5
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFi…
-
Medium 6.5
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromwebExcptypema…
-
Medium 6.5
Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the pptpPPW parameter in the fromAdvSetWan fun…