COMMON WEAKNESS ENUMERATIONIncomplete

CWE-409

Improper Handling of Highly Compressed Data (Data Amplification)

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Genişletilmiş açıklama

An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

DoS: AmplificationDoS: Crash, Exit, or RestartDoS: Resource Consumption (CPU)DoS: Resource Consumption (Memory)

Etkilenen güvenlik alanları: Availability

System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.

Savunma

Nasıl önlenir ve çözülür?

  • Follow secure coding guidelines for input handling and boundary checking.
  • Enforce strict security reviews and automated static analysis (SAST) checks.