CWE-755: Improper Handling of Exceptional Conditions

How it's found

Improper Handling of Exceptional Conditions describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.

Vulnerable vs. safe

//We do nothing so we just ignore the error.foo=malloc(sizeof(char)); //the next line checks to see if malloc failedif (foo==NULL) {}

printf("Malloc failed to allocate memory resources");return -1;foo=malloc(sizeof(char)); //the next line checks to see if malloc failedif (foo==NULL) {}

Consequences

• Other

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Pillar weakness
  CWE-703: Improper Check or Handling of Exceptional Conditions