CWE WEAKNESSES  /  CWE-129

CWE-129

Improper Validation of Array Index

What it is

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Impact

Mitigations

• [Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
• [Architecture and Design]For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.Even though c
• [Requirements]Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.For example, Ada allows the programmer to constrain the values of a variable and languages such as Java and Ruby will allow the programmer to handle exceptions when an out-of-bounds index is accessed.
• [Operation, Build and Compilation]Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory. Because this makes the addresses unpredictable, it can prevent an attacker from reliably jumping to exploitable code.Examples include Address Space Layout Randomization (ASLR) [REF-58] [REF-60] and Position-Independent Executables (PIE) [REF-64]. Im
• [Operation]Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX [REF-60] [REF-61]. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment.For more information on these techniques see D3-PSEP (Process Segment
• [Implementation]Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.When performing input validation, consider all potentially relevant properties, including length, type of input, the full r
• [Implementation] Be especially careful to validate all input when invoking code that crosses language boundaries, such as from an interpreted language to native code. This could create an unexpected interaction between the language boundaries. Ensure that you are not violating any of the expectations of the language with which you are interfacing. For example, even though Java may not be susceptible to buffer over
• [Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database ad

Real-world CVE examples

• CVE-2005-0369 — large ID in packet used as array index
• CVE-2001-1009 — negative array index as argument to POP LIST command
• CVE-2003-0721 — Integer signedness error leads to negative array index
• CVE-2004-1189 — product does not properly track a count and a maximum number, which can lead to resultant array index overflow.
• CVE-2007-5756 — Chain: device driver for packet-capturing software allows access to an unintended IOCTL with resultant array index error.
• CVE-2005-2456 — Chain: array index error (CWE-129) leads to deadlock (CWE-833)

Related weaknesses

Source: MITRE CWE. View on cwe.mitre.org →