CWE一覧に戻る
CWE-410

リソースプール不足

Insufficient Resource Pool
脆弱性 作成中
JA

この製品のリソースプールは、ピーク時の需要に対応するのに十分な大きさがないため、攻撃者は(比較的)多くのリソースへのリクエストを使用することで、他の人がリソースにアクセスするのを防ぐことができる。

その結果、接続やセッションが "殺到 "することがよくある。

EN

The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

Frequently the consequence is a "flood" of connection or sessions.

Scope: Availability, Integrity, Other / Impact: DoS: Crash, Exit, or Restart; Other
Do not perform resource-intensive transactions for unauthenticated users and/or invalid requests.
Consider implementing a velocity check mechanism which would detect abusive behavior.
Consider load balancing as an option to handle heavy loads.
Make sure that resource handles are properly closed when no longer needed.
Identify the system's resource intensive operations and consider protecting them from abuse (e.g. malicious automated script which runs the resources out).
MITRE公式ページ — CWE-410