Comparing instead of assigning

From OWASP

Jump to: navigation, search

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.

Contents


ASDR Table of Contents

Last revision (mm/dd/yy): 10/30/2008

Description

In many languages, the compare statement is very close in appearance to the assignment statement; they are often confused.

Consequences

Unspecified.

Exposure period

  • Pre-design through Build: The use of tools to detect this problem is recommended.
  • Implementation: Many logic errors can lead to this condition. It can be exacerbated by lack, or misuse, of mitigating technologies.

Platform

  • Languages: C, C++, Java
  • Operating platforms: Any

Required resources

Any

Severity

High

Likelihood of exploit

Low

This bug is mainly a typo and usually should cause obvious problems with program execution. The assignment will not always take place.

Risk Factors

  • Talk about the factors that make this vulnerability likely or unlikely to actually happen
  • Discuss the technical impact of a successful exploit of this vulnerability
  • Consider the likely [business impacts] of a successful attack


Examples

In C/C++/Java: 

void called(int foo){
        foo==1;
        if (foo==1) printf("foo\n");
}

int main(){
        called(2);
        return 0;
}

Related Attacks


Related Vulnerabilities


Related Controls

  • Control 1
  • Control 2
  • Pre-design: Through Build: Many IDEs and static analysis products will detect this problem.

Related Technical Impacts


References

TBD

Retrieved from "http://www.owasp.org/index.php/Comparing_instead_of_assigning"
Personal tools
Language