Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am in the process of writing up a vulnerability report for a thick client application. One of the findings for the executable is ASLR being disabled. As part of reporting, I'm required to provide a CWE to the client that best describes the vulnerability. I can't seem to find a strong CWE that describes ASLR being disabled.

Some of my co-workers have used but that is just wrong, as that CWE does not describe anything along the lines of the randomization that ASLR tries to perform.

What CWE have people used in the past?

Thanks in advanced.

share|improve this question

CWE doesn't enlist lack of ASLR explicitly as an entry, but I believe it definitely comes under "Security Misconfiguration" CWE-815 as Rook has stated above.

Additionally, I wanted to add that Buffer Access Using Size of Source Buffer CWE-806 clearly recommends it as one of multiple necessary measures for system hardening against overflow based attacks. The exact statement is as follows:-

Phase: Operation
Strategy: Environment Hardening
Use a feature like Address Space Layout Randomization (ASLR) [R.806.3] [R.806.5].
Effectiveness: Defense in Depth
This is not a complete solution. However, it forces the attacker to guess an unknown value that changes every program execution. In addition, an attack could still cause a denial of service, since the typical response is to exit the application.

Also, although the OWASP Project identifies it as a Wiki Page and weakness, it doesn't state which category it falls under at this point of time (Seems like a good thing to contribute to). :( Ref:

share|improve this answer

Despite having thousands of entries, the CWE system is not granular enough to express this specific violation. However, there are more general CWE families that could help. CWE-2: Environment looks like the right parent node, or perhaps CWE-815 Security Misconfiguration would be more exact.

share|improve this answer
Thanks Rook. I've looked at a few of those, but decided to go with Although I wouldn't say ASLR is "sufficient defense" like the CWE site says, but it definitely is something that helps exploit mitigation. In my opinion MITRE should update their CWE list to contain an entry for compile time issues such as ASLR, DEP, etc. – eliteparakeet Jul 10 '13 at 16:17
@eliteparakeet You could email them the suggestion, they like hearing new suggestions. The CWE system is built to help us, and they like our feedback. – rook Jul 10 '13 at 16:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.