CWE - 400 : Uncontrolled Resource Consumption ('Resource Exhaustion')
CWE Definition
|
http://cwe.mitre.org/data/definitions/400.html
|
Number of vulnerabilities:
|
1342
|
Description
|
The software does not properly restrict the size or amount of
resources that are requested or influenced by an actor, which can be used to
consume more resources than intended.Limited resources include memory, file system storage, database connection
pool entries, or CPU. If an attacker can trigger the allocation of these
limited resources, but the number or size of the resources is not
controlled, then the attacker could cause a denial of service that consumes
all available resources. This would prevent valid users from accessing the
software, and it could potentially have an impact on the surrounding
environment. For example, a memory exhaustion attack against an application
could slow down the application as well as its host operating system. |
Background Details
|
|
Other Notes
|
Database queries that take a long time to process are good DoS targets. An
attacker would have to write a few lines of Perl code to generate enough
traffic to exceed the site's ability to keep up. This would effectively
prevent authorized users from using the site at all. Resources can be
exploited simply by ensuring that the target machine must do much more work
and consume more resources in order to service a request than the attacker
must do to initiate a request. |
|
|
Warning! CWE definitions are provided as a quick reference. They are
not complete and may not be up to date!
You must visit
http://cwe.mitre.org/ for a complete list of CWE entries
and for more details.