Fallos del tipo CWE-399

160 resultados

Erros de Gerenciamento de Recursos

Fraqueza genérica que abrange falhas na alocação, uso e liberação de recursos do sistema (memória, conexões, arquivos, sockets). O código não rastreia ou libera corretamente esses recursos, causando vazamentos, esgotamento ou acesso inválido que leva a crash, negação de serviço ou exploração.

Ejemplo

Um servidor web abre uma conexão com banco de dados para cada requisição, mas não a fecha se uma exceção ocorre no meio do processamento. Após centenas de requisições, todas as conexões disponíveis estão em uso e novas requisições falham. Um atacante pode disparar requisições malformadas para manter conexões abertas indefinidamente.

Cómo mitigar

Use padrões de limpeza automática (try-finally, context managers em Python, using em C#) para garantir liberação de recursos mesmo em erro. Implemente timeouts, limites de recursos por processo e monitoramento de vazamento. Audite rotineiramente código que abre/fecha conexões, arquivos ou aloca memória.

CVE-2017-3790—A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software coEPSS 3.5%CVE-2018-0421—Cisco Prime Access Registrar Denial of Service VulnerabilityEPSS 3.5%CVE-2018-0332—A vulnerability in the Session Initiation Protocol (SIP) ingress packet processing of Cisco Unified IP Phone software could allow an unautheEPSS 3.4%CVE-2018-0443HIGHCisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Denial of Service VulnerabilityEPSS 3.4%CVE-2022-20625MEDIUMCisco FXOS and NX-OS Software Cisco Discovery Protocol Service Denial of Service VulnerabilityEPSS 3.3%CVE-2018-0273—A vulnerability in the IPsec Manager of Cisco StarOS for Cisco Aggregation Services Router (ASR) 5000 Series Routers and Virtualized Packet EPSS 3.2%CVE-2018-0286—A vulnerability in the netconf interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of serviEPSS 3.2%CVE-2017-12250—A vulnerability in the HTTP web interface for Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker toEPSS 3.1%CVE-2017-12355—A vulnerability in the Local Packet Transport Services (LPTS) ingress frame-processing functionality of Cisco IOS XR Software could allow anEPSS 3.1%CVE-2018-15458MEDIUMCisco Firepower Management Center Disk Utilization Denial of Service VulnerabilityEPSS 3.1%CVE-2017-6610—A vulnerability in the Internet Key Exchange Version 1 (IKEv1) XAUTH code of Cisco ASA Software could allow an authenticated, remote attackeEPSS 3.0%CVE-2016-6368—A vulnerability in the detection engine parsing of Pragmatic General Multicast (PGM) protocol packets for Cisco Firepower System Software coEPSS 3.0%CVE-2017-6609—A vulnerability in the IPsec code of Cisco ASA Software could allow an authenticated, remote attacker to cause a reload of the affected systEPSS 2.8%CVE-2018-0311—A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remotEPSS 2.8%CVE-2019-12652HIGHCisco Catalyst 4000 Series Switches TCP Denial of Service VulnerabilityEPSS 2.7%CVE-2017-3864—A vulnerability in the DHCP client implementation of Cisco IOS (12.2, 12.4, and 15.0 through 15.6) and Cisco IOS XE (3.3 through 3.7) could EPSS 2.7%CVE-2017-12219—A vulnerability in the handling of IP fragments for the Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones could allow an unauEPSS 2.7%CVE-2016-9225—A vulnerability in the data plane IP fragment handler of the Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security module could EPSS 2.7%CVE-2017-3857—A vulnerability in the Layer 2 Tunneling Protocol (L2TP) parsing function of Cisco IOS (12.0 through 12.4 and 15.0 through 15.6) and Cisco IEPSS 2.6%CVE-2019-1718MEDIUMCisco Identity Services Engine SSL Renegotiation Denial of Service VulnerabilityEPSS 2.5%