Weakness (CWE)
CWE-170: Improper Null Termination
The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
How to prevent it (5 mitigations)
-
Requirements
Use a language that is not susceptible to these issues. However, be careful of null byte interaction errors (CWE-626) with lower-level constructs that may be written in a language that is susceptible.
-
Implementation
Ensure that all string functions used are understood fully as to how they append null characters. Also, be wary of off-by-one errors when appending nulls to the end of strings.
-
Implementation
If performance constraints permit, special code can be added that validates null-termination of string buffers, this is a rather naive and error-prone solution.
-
Implementation
Switch to bounded string manipulation functions. Inspect buffer lengths involved in the buffer overrun trace reported with the defect.
-
Implementation
Add code that fills buffers with nulls (however, the length of buffers still needs to be inspected, to ensure that the non null-terminated string is not written at the physical end of the buffer).
Source: MITRE CWE-170
23 results · Clear filters · Feed
-
Medium 4.8
Irontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packet
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a …
-
Medium 6.5
Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the `PJSIP…
-
Medium 5.5
Windows Modern Device Management (MDM) Information Disclosure Vulnerability
Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows USB Print Driver Information Disclosure Vulnerability
Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.
-
Medium 4.3
VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-depend…
-
Medium 5.5
Microsoft Office Word Information Disclosure Vulnerability
Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
-
Medium 5.9
h2o is vulnerable to heap overrun
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying t…
-
Medium 5.3
Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
-
Medium 4.0
mackron / miniaudio Out-of-Bounds Read in BEXT Coding History Parsing
miniaudio version 0.11.25 and earlier (fixed in commits 1df46ae and 1df46ae) contain a heap out-of-bounds read vulnerability in the WAV BEXT metadata parser that allows attackers to trigger memory access violations by processing crafted WAV files. Attackers c…
-
Medium 6.1
iccDEV has a heap-buffer-overflow in icXmlParseTextString()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, a heap buffer over-read when the strlen() function attempts to read a non-null-terminated bu…
-
Medium 6.1
iccDEV has Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are vulnerable to Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination through its CIccTagText::Read function. This…
-
Medium 5.0
Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHE…
-
Medium 6.9
Wazuh vulnerable to Heap-based Buffer Over-read in w_expression_match
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.12.0, a buffer over-read occurs in w_expression_match() when strlen() is called on str_test, because the corresponding buffer is not being properly NULL t…
-
Medium 5.5
python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. An…
-
Medium 5.3
Improper Null Termination in libfluid_msg library
Improper Null Termination vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with program routine fluid_msg::of10::Port:unpack. This issue affects libfluid: 0.1.0.
-
Medium 6.8
Dell Platform BIOS contains an Improper Null Termination vulnerability. A high privilege user with network access to th…
-
Medium 5.5
Windows Cryptographic Services Information Disclosure Vulnerability
Windows Cryptographic Services Information Disclosure Vulnerability
-
Medium 5.5
Windows Cryptographic Services Information Disclosure Vulnerability
Windows Cryptographic Services Information Disclosure Vulnerability
-
Medium 6.5
Windows Deployment Services Denial of Service Vulnerability
Windows Deployment Services Denial of Service Vulnerability
-
Medium 5.5
Visual Studio Information Disclosure Vulnerability
Visual Studio Information Disclosure Vulnerability
-
Medium 6.5
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethe…
-
Medium 5.5
A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and befo…
-
Medium 5.3
get_headers() silently truncates after a null byte
In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect a…