Null Dereference - Revision history

Imifos: Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2017-11-10T11:48:26Z

Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

Imifos at 13:07, 1 December 2015

2015-12-01T13:07:57Z

Jmanico at 18:39, 5 April 2014

2014-04-05T18:39:44Z

Jmanico at 18:37, 5 April 2014

2014-04-05T18:37:22Z

Jmanico: /* Description */

2014-04-05T18:33:10Z

‎Description

Jmanico at 18:30, 5 April 2014

2014-04-05T18:30:36Z

Jmanico at 18:30, 5 April 2014

2014-04-05T18:30:27Z

Jmanico: /* Risk Factors */

2014-04-05T18:19:42Z

‎Risk Factors

Jmanico: removing vendor branding and ASDR project reference (dead project)

2014-04-05T18:18:36Z

removing vendor branding and ASDR project reference (dead project)

Kyledenim: Small typos resolved

2014-03-25T13:09:16Z

Small typos resolved

@@ Line 72: / Line 72: @@
 [[Category:Code Quality Vulnerability]]
-[[Category:OWASP Java Project]]
+[[Category:Java]]
 [[Category:Vulnerability]]

@@ Line 72: / Line 72: @@
 [[Category:Code Quality Vulnerability]]
-[[Category:Java]]
+[[Category:OWASP Java Project]]
 [[Category:Vulnerability]]

@@ Line 8: / Line 8: @@
 Null-pointer dereferences, while common, can generally be found and corrected in a simple way. They will always result in the crash of the process, unless exception handling (on some platforms) is invoked, and even then, little can be done to salvage the process.
-'''Consequences'''
+= Consequences =
 * Availability: Null-pointer dereferences invariably result in the failure of the process.
-'''Exposure period'''
+= Exposure period =
 * Requirements specification: The choice could be made to use a language that is not susceptible to these issues.
 * Implementation: Proper sanity checks at implementation time can serve to prevent null-pointer dereferences
-'''Platform'''
+= Platform =
 * Languages: C, C++, Java, Assembly
 * Platforms: All
-==Examples==
+= Examples =
-===Example 1===
+== Example 1 ==
 In the following code, the programmer assumes that the system always has a property named "cmd" defined. If an attacker can control the program's environment so that "cmd" is not defined, the program throws a null pointer exception when it attempts to call the trim() method.
@@ Line 31: / Line 31: @@
 	cmd = cmd.trim();
-===Example 2===
+== Example 2 ==
 Null-pointer dereference issues can occur through a number of flaws, including race conditions and simple programming omissions. While there are no complete fixes aside from contentious programming, the following steps will go a long way to ensure that null-pointer dereferences do not occur.
@@ Line 55: / Line 55: @@
 If you are working with a multi-threaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the if statement; and unlock when it has finished.
-==Related [[Vulnerabilities]]==
+= Related [[Vulnerabilities]] =
 * [[Miscalculated null termination]]
 * [[State synchronization error]]
-==Related [[Controls]]==
+= Related [[Controls]] =
 * Requirements specification: The choice could be made to use a language that is not susceptible to these issues.
 * Implementation: If all pointers that could have been modified are sanity-checked previous to use, nearly all null-pointer dereferences can be prevented.
-==References==
+= References =
 * [http://cwe.mitre.org/data/definitions/79.html CWE 79].

← Older revision		Revision as of 18:37, 5 April 2014
Line 1:		Line 1:
		+	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
		+
	=Description=		=Description=
	The program can potentially dereference a null pointer, thereby raising a NullPointerException. Null pointer errors are usually the result of one or more programmer assumptions being violated. Most null pointer issues result in general software reliability problems, but if an attacker can intentionally trigger a null pointer dereference, the attacker might be able to use the resulting exception to bypass security logic or to cause the application to reveal debugging information that will be valuable in planning subsequent attacks.		The program can potentially dereference a null pointer, thereby raising a NullPointerException. Null pointer errors are usually the result of one or more programmer assumptions being violated. Most null pointer issues result in general software reliability problems, but if an attacker can intentionally trigger a null pointer dereference, the attacker might be able to use the resulting exception to bypass security logic or to cause the application to reveal debugging information that will be valuable in planning subsequent attacks.

@@ Line 1: / Line 1: @@
 =Description=
-The program can potentially dereference a null pointer, thereby raising a NullPointerException.
+The program can potentially dereference a null pointer, thereby raising a NullPointerException. Null pointer errors are usually the result of one or more programmer assumptions being violated. Most null pointer issues result in general software reliability problems, but if an attacker can intentionally trigger a null pointer dereference, the attacker might be able to use the resulting exception to bypass security logic or to cause the application to reveal debugging information that will be valuable in planning subsequent attacks.
 A null-pointer dereference takes place when a pointer with a value of NULL is used as though it pointed to a valid memory area.

← Older revision		Revision as of 18:30, 5 April 2014
Line 1:		Line 1:
−	~~{{Template:Vulnerability}}~~
−
	=Description=		=Description=
	The program can potentially dereference a null pointer, thereby raising a NullPointerException.		The program can potentially dereference a null pointer, thereby raising a NullPointerException.

← Older revision		Revision as of 18:19, 5 April 2014
Line 37:		Line 37:

	Null-pointer dereferences, while common, can generally be found and corrected in a simple way. They will always result in the crash of the process, unless exception handling (on some platforms) is invoked, and even then, little can be done to salvage the process.		Null-pointer dereferences, while common, can generally be found and corrected in a simple way. They will always result in the crash of the process, unless exception handling (on some platforms) is invoked, and even then, little can be done to salvage the process.
−
−	~~==Risk Factors==~~
−
−	~~TBD~~

	==Examples==		==Examples==

@@ Line 42: / Line 42: @@
 Medium
-Null-pointer dereferences, while common, can generally be found and corrected in a simply way. They will always result in the crash of the process, unless exception handling (on some platforms) in invoked, and even then, little can be done to salvage the process.
+Null-pointer dereferences, while common, can generally be found and corrected in a simple way. They will always result in the crash of the process, unless exception handling (on some platforms) is invoked, and even then, little can be done to salvage the process.
 ==Risk Factors==