Modes Of Introduction
Operation
Architecture and Design : If the application uses UDP, then it could potentially be subject to spoofing attacks that use the inherent weaknesses of UDP to perform traffic amplification, although this problem can exist in other protocols or contexts.
Implementation
Applicable Platforms
Language
Class: Not Language-Specific (Undetermined)
Common Consequences
Scope |
Impact |
Likelihood |
Availability | DoS: Amplification, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
Note: System resources can be quickly consumed leading to poor application performance or system crash. This may affect network performance and could be used to attack other systems and applications relying on network performance. | |
Observed Examples
References |
Description |
| Classic "Smurf" attack, using spoofed ICMP packets to broadcast addresses. |
| DNS query with spoofed source address causes more traffic to be returned to spoofed address than was sent by the attacker. |
| Large datagrams are sent in response to malformed datagrams. |
| Game server sends a large amount. |
| composite: NTP feature generates large responses (high amplification factor) with spoofed UDP source addresses. |
Potential Mitigations
Phases : Architecture and Design
An application must make network resources available to a client commensurate with the client's access level.
Phases : Policy
Define a clear policy for network resource allocation and consumption.
Phases : Implementation
An application must, at all times, keep track of network resources and meter their usage appropriately.
Vulnerability Mapping Notes
Justification : This CWE entry is a Class, but it does not have Base-level children.
Comment : This entry is classified in a part of CWE's hierarchy that does not have sufficiently low-level coverage, which might reflect a lack of classification-oriented weakness research in the software security community. Conduct careful root cause analysis to determine the original mistake that led to this weakness. If closer analysis reveals that this weakness is appropriate, then this might be the best available CWE to use for mapping. If no other option is available, then it is acceptable to map to this CWE.
NotesNotes
This can be resultant from weaknesses that simplify spoofing attacks.
Network amplification, when performed with spoofing, is normally a multi-channel attack from attacker (acting as user) to amplifier, and amplifier to victim.
Submission
Name |
Organization |
Date |
Date release |
Version |
PLOVER |
|
2006-07-19 +00:00 |
2006-07-19 +00:00 |
Draft 3 |
Modifications
Name |
Organization |
Date |
Comment |
Eric Dalci |
Cigital |
2008-07-01 +00:00 |
updated Time_of_Introduction |
CWE Content Team |
MITRE |
2008-09-08 +00:00 |
updated Relationships, Other_Notes, Taxonomy_Mappings |
CWE Content Team |
MITRE |
2008-10-14 +00:00 |
updated Description, Enabling_Factors_for_Exploitation, Name, Other_Notes, Theoretical_Notes |
CWE Content Team |
MITRE |
2010-06-21 +00:00 |
updated Other_Notes, Relationship_Notes |
CWE Content Team |
MITRE |
2011-03-29 +00:00 |
updated Demonstrative_Examples |
CWE Content Team |
MITRE |
2011-06-01 +00:00 |
updated Common_Consequences |
CWE Content Team |
MITRE |
2012-05-11 +00:00 |
updated Common_Consequences, Relationships |
CWE Content Team |
MITRE |
2012-10-30 +00:00 |
updated Potential_Mitigations |
CWE Content Team |
MITRE |
2014-02-18 +00:00 |
updated Demonstrative_Examples, Observed_Examples, Relationships |
CWE Content Team |
MITRE |
2014-07-30 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2017-11-08 +00:00 |
updated Applicable_Platforms, Enabling_Factors_for_Exploitation, Modes_of_Introduction |
CWE Content Team |
MITRE |
2019-06-20 +00:00 |
updated Type |
CWE Content Team |
MITRE |
2020-02-24 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2022-04-28 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2023-01-31 +00:00 |
updated Description |
CWE Content Team |
MITRE |
2023-04-27 +00:00 |
updated Relationships |
CWE Content Team |
MITRE |
2023-06-29 +00:00 |
updated Mapping_Notes |
CWE Content Team |
MITRE |
2025-04-03 +00:00 |
updated Mapping_Notes |