Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

This is not really another heartbleed question. I don't want to go into massive detail on how the error happened, how heartbleed works, etc.

To summarize, the programmer (whether forgetting to, or just naivety) relied on the clients specification of how large the payload was. In this case it was a critical error because that alleged payload was returned to the client as confirmation/keep-alive/whatever.

Massive amounts of people are incorrectly calling this a buffer overflow attack, which it is not. The buffer was simply created to store an amount of data that was specified by the client.

My question is: Is there a well-defined term for this type of exploit, or even the type of coding overlook (I wouldn't call this an error outright, though some might and that's debatable)?

share|improve this question

closed as primarily opinion-based by gnat, Bart van Ingen Schenau, MichaelT, World Engineer Apr 16 at 14:41

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

It's a buffer overflow, but reading rather than writing. We used to do coredumps this way, before segmented architectures. –  david.pfx Apr 16 at 15:25

1 Answer 1

up vote 6 down vote accepted

CWE calls it a "Buffer Over-read".

The software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer. CWE-126:

share|improve this answer
is this a "well-defined term", as asked in the question? –  gnat Apr 16 at 13:00
CWE is closest I can find as to "official naming". That and the term is widely used and describes the problem at hand. –  Pieter B Apr 16 at 13:07
Much more established, but more general is undefined behaviour. C is chock-full of undefined behaviour, and usually it can be exploited by crafty attackers who know what really happens rather than what the language standard guarantees. Tricking a program into disclosing information or into executing self-destructive code are ultimately very similar applications of this fact. –  Kilian Foth Apr 16 at 13:16
@Doval no it's not. It's very basically, I send a keep-alive packet which gets assigned a buffer and ask the server to reply to me back that buffer of "length". The attack is to specify a larger length then the keepalive packet you sent so you get more information then is put into the buffer. –  Pieter B Apr 16 at 13:32
+1, the text under example one says However, the message length variable from the structure is used as the condition for ending the for loop without validating that the message length variable accurately reflects the length of message body. This can result in a buffer over read by reading from memory beyond the bounds of the buffer if the message length variable indicates a length that is longer than the size of a message body. I guess this is probably about as well defined as it would get, since buffer overflow steals the spotlight all the time. –  BigHomie Apr 16 at 13:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.