Abstract:

The method Equals() in Program.cs can dereference a null pointer on line 19, thereby raising a NullException.


Explanation:

Null pointer errors are usually the result of one or more programmer assumptions being violated.

In this case the variable can be null when it is dereferenced at line 19, thereby raising a NullException.

Most null pointer issues result in general software reliability problems, but if an attacker can intentionally trigger a null pointer dereference, the attacker may be able to use the resulting exception to bypass security logic or to cause the application to reveal debugging information that will be valuable in planning subsequent attacks.

Example 1: In the following code, the programmer assumes that the system always has a property named "cmd" defined. If an attacker can control the program's environment so that "cmd" is not defined, the program throws a null pointer exception when it attempts to call the Trim() method.


string cmd = null;
...
cmd = Environment.GetEnvironmentVariable("cmd");
cmd = cmd.Trim();




Instance ID: CE307A60AE76EB68D6DA1A9EDEB8F21F

Priority Metadata Values:

	IMPACT: 3.0

	LIKELIHOOD: 0.8

Legacy Priority Metadata Values:

	SEVERITY: 3.0

	CONFIDENCE: 5.0