Weakness (CWE)
CWE-130: Improper Handling of Length Parameter Inconsistency
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
More detail
If an attacker can manipulate the length parameter associated with an input such that it is inconsistent with the actual length of the input, this can be leveraged to cause the target application to behave in unexpected, and possibly, malicious ways. One of the possible motives for doing so is to pass in arbitrarily large input to the application. Another possible motivation is the modification of application state by including invalid data for subsequent properties of the application. Such weaknesses commonly lead to attacks such as buffer overflows and execution of arbitrary code.
How to prevent it (3 mitigations)
-
Implementation
When processing structured incoming data containing a size field followed by raw data, ensure that you identify and resolve any inconsistencies between the size field and the actual size of the data.
-
Implementation
Do not let the user control the size of the buffer.
-
Implementation
Validate that the length of the user-supplied data is consistent with the buffer size.
Source: MITRE CWE-130
58 results · Clear filters · Feed
-
Medium 6.5
A vulnerability in the upload module of Cisco RV340 and RV345 Dual WAN Gigabit VPN Routers could allow an authenticated…
-
Medium 6.2
Tor Arti's STUB circuits incorrectly have a length of 2
In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.
-
Medium 5.9
Azure Private 5G Core Denial of Service Vulnerability
Azure Private 5G Core Denial of Service Vulnerability
-
Medium 6.2
Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability
-
Medium 4.9
A denial of service vulnerability exists in the OAS Engine File Data Source Configuration functionality of Open Automat…
-
Medium 4.5
CKAN out of memory error when submitting the dataset form with a specially-crafted field
CKAN is an open-source data management system for powering data hubs and data portals. Starting in version 2.0.0 and prior to versions 2.9.10 and 2.10.3, when submitting a POST request to the `/dataset/new` endpoint (including either the auth cookie or the `A…
-
Medium 5.3CVE-2023-40167 Public exploit
Jetty accepts "+" prefixed value in Content-Length
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…
-
Medium 5.3
Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter…
-
Medium 5.3
Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter…
-
Medium 5.3
Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telep…
-
Medium 4.7
L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with an invalid length during Ethernet to Wifi frame translation
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length and Ethernet to Wifi frame conversion (and optionally VLAN0 headers).
-
Medium 4.7
L2 network filtering bypass using stacked VLAN0 and LLC/SNAP headers with invalid lengths
Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length (and optionally VLAN0 headers)
-
Medium 5.7
Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
-
Medium 5.3
Improper Handling of Length Parameter Inconsistency in ikus060/rdiffweb
Improper Handling of Length Parameter Inconsistency in GitHub repository ikus060/rdiffweb prior to 2.4.8.
-
Medium 4.3
Truncated L2CAP K-frame causes assertion failure
Truncated L2CAP K-frame causes assertion failure. Zephyr versions >= 2.4.0, >= v.2.50 contain Improper Handling of Length Parameter Inconsistency (CWE-130), Reachable Assertion (CWE-617). For more information, see https://github.com/zephyrproject-rtos/zephyr/…
-
Medium 5.5
Apache Ant ZIP, and ZIP based, archive denial of service vulerability
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly …
-
Medium 5.5
Apache Ant TAR archive denial of service vulnerability
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.…
-
Medium 5.3CVE-2020-8927 Public exploit
Buffer overflow in Brotli library
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It i…