COMMON WEAKNESS ENUMERATIONIncomplete

CWE-410

Insufficient Resource Pool

The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Soyutlama

Class

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Genişletilmiş açıklama

Frequently the consequence is a "flood" of connection or sessions.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

Yaşam döngüsü evresi

Implementation

Yaşam döngüsü evresi

Operation

Risk

Başarılı sömürü neye yol açar?

DoS: Crash, Exit, or RestartOther

Etkilenen güvenlik alanları: Availability, Integrity, Other

Floods often cause a crash or other problem besides denial of the resource itself; these are likely examples of *other* vulnerabilities, not an insufficient resource pool.

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
Consider implementing a velocity check mechanism which would detect abusive behavior.

Operation

Operasyonel savunma

Detay
Consider load balancing as an option to handle heavy loads.

Implementation

Uygulama aşaması savunması

Detay
Make sure that resource handles are properly closed when no longer needed.

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).