What is CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')?+
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
What are the security consequences of Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')?+
If exploited, CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')) it can compromise Integrity, Confidentiality and Availability, leading to outcomes such as Modify Memory, Execute Unauthorized Code or Commands, DoS: Crash, Exit, or Restart and DoS: Resource Consumption (CPU).
How do you prevent or mitigate Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')?+
Recommended mitigations for CWE-120 include: Most mitigating technologies at the compiler or OS level to date address only a subset of buffer overflow problems and rarely provide complete protection against even that subset. It is good practice to implement strategies to increase the workload of an attacker, such as leaving the attacker to guess an unknown value that changes every program execution.
How is Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') detected?+
CWE-120 can be detected using Automated Static Analysis - Binary or Bytecode, Manual Static Analysis - Binary or Bytecode, Dynamic Analysis with Automated Results Interpretation, Dynamic Analysis with Manual Results Interpretation, Manual Static Analysis - Source Code and Automated Static Analysis - Source Code. Combining automated tooling with manual review typically yields the best coverage.
Which programming languages are affected by Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')?+
CWE-120 commonly affects C, C++, Memory-Unsafe and Assembly. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')?+
MITRE documents real CVEs mapped to CWE-120, including CVE-2000-1094, CVE-1999-0046, CVE-2002-1337, CVE-2003-0595 and CVE-2001-0191. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-120 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.