Weakness (CWE)
CWE-121: Stack-based Buffer Overflow
The product writes past the end of a buffer that was allocated on the stack.
How to prevent it (5 mitigations)
-
Operation, Build and Compilation
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking.
D3-SFCV (Stack Frame Canary Validation) from D3FEND [REF-1334] discusses canary-based detection in detail.
-
Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
-
Implementation
Implement and perform bounds checking on input.
-
Implementation
Do not use dangerous functions such as gets. Use safer, equivalent functions which check for boundary errors.
-
Operation, Build and Compilation
Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.
Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Imported modules may be similarly realigned if their default memory addresses conflict with other modules, in a process known as "rebasing" (for Windows) and "prelinking" (for Linux) [REF-1332] using randomly generated addresses. ASLR for libraries cannot be used in conjunction with prelink since it would require relocating the libraries at run-time, defeating the whole purpose of prelinking.
For more information on these techniques see D3-SAOR (Segment Address Offset Randomization) from D3FEND [REF-1335].
Source: MITRE CWE-121
4,194 results · Feed
-
High 8.1
Windows DHCP Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows MIDI Service Module Elevation of Privileges Vulnerability
Stack-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows USB Driver Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Graphics Component Elevation of Privilege Vulnerability
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows Win32k Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows NTFS Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Windows NTFS Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.5
Microsoft SQL Server Remote Code Execution Vulnerability
Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Graphics Component Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Netlogon Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Storage Management Provider Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows Win32k Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Windows Win32k Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Windows NTFS Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code over a network.
-
High 8.0
Windows DHCP Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network.
-
High 7.8
Windows Broker Infrastructure Service Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Broker Infrastructure Service allows an authorized attacker to elevate privileges locally.
-
High 8.0
Windows Fast FAT Driver Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Fast FAT Driver allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
-
Low 3.5
Insufficient input validation vulnerability exists in certain NETGEAR RAX Models
An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. There is no confidentiality or integrity impact. A …
-
High 8.7
CommServe Stack-based Buffer Overflow
CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
-
Medium 6.3
vgmstream txth-txtp txth.c sscanf stack-based overflow
A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the component txth-txtp. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. Th…
-
Critical 9.6
D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow
A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local net…
-
Medium 5.3
java-json-tools json-patch JsonMergePatchDeserializer.java JsonMergePatch.fromJson stack-based overflow
A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchDeserializer.java. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from re…
-
Critical 10.0
D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow
A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out…
-
Low 2.3
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write…
-
Medium 6.7
In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
High 8.0
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
-
Medium 6.3
PJSIP: Pre-authentication overflow in the telnet CLI error
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when rendering feedback for an entered command line. Several command-line handling pa…
-
Medium 6.3
PJSIP: Pre-authentication overflow in the telnet CLI history
PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall (handle_up_down() in cli_telnet…
-
High 8.8
PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend
PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a151a, a stack buffer overflow exists in the GnuTLS TLS backend when parsing the Subject Alternative Name extension of a peer certificate (tls_cert_get_info() in …
-
High 8.8
PJSIP: Stack overflow parsing SDP a=crypto attributes
PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport…
-
High 8.8
PJSIP: Stack overflow handling Service-Route headers in a registration response
PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing Service-Route headers in a registration response (update_service_route() in pjsua_acc.c). This affe…
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in Debug Server
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.
-
Medium 4.3
IBM i is Affected By Multiple Vulnerabilities in Debug Server
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stack-based buffer overflow.
-
Critical 9.8
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC ret…