CWE-410 不充分的资源池

Insufficient Resource Pool

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

The software's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

扩展描述

Frequently the consequence is a "flood" of connection or sessions.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 664 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: CanPrecede cwe_CWE_ID: 400 cwe_View_ID: 1000

• cwe_Nature: CanPrecede cwe_CWE_ID: 400 cwe_View_ID: 699

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

可能的缓解方案

Architecture and Design

策略:

Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.

Architecture and Design

策略:

Consider implementing a velocity check mechanism which would detect abusive behavior.

Operation

策略:

Consider load balancing as an option to handle heavy loads.

Implementation

策略:

Make sure that resource handles are properly closed when no longer needed.

Architecture and Design

策略:

Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).

示例代码

例

In the following snippet from a Tomcat configuration file, a JDBC connection pool is defined with a maximum of 5 simultaneous connections (with a 60 second timeout). In this case, it may be trivial for an attacker to instigate a denial of service (DoS) by using up all of the available connections in the pool.

bad XML

分析过的案例

分类映射

引用

• REF-7 Writing Secure Code