Skip to content

Latest commit

 

History

History
36 lines (24 loc) · 2.32 KB

attack-tree.md

File metadata and controls

36 lines (24 loc) · 2.32 KB

Attack Tree Analysis for academysoftwarefoundation/openvdb

Objective: Arbitrary Code Execution on Server

Attack Tree Visualization

                                 [Arbitrary Code Execution on Server]***
                                                |
      -------------------------------------------------------------------------------------------------
      |                                               |                                               |

[Exploit OpenVDB Parsing/Processing] [Exploit OpenVDB Memory Management] [Exploit OpenVDB API Misuse (by Application)]*** | | |

| | | | | | [Fuzzing Input] [Malicious VDB File] [Integer Overflow] [Buffer Overflow]*** [Unsafe API Calls by App]*** | | | | | [Crafted Data] [Oversized Data] [Out-of-Bounds Read/Write]*** [Unvalidated User Input]*** | | | [Code Execution]*** [Code Execution]***

Attack Tree Path: Path 1

[Arbitrary Code Execution on Server]*** ===> [Exploit OpenVDB API Misuse (by Application)]*** ===> [Unsafe API Calls by App]*** ===> [Unvalidated User Input]*** ===> [Code Execution]***

Attack Tree Path: Path 2

[Arbitrary Code Execution on Server]*** ===> [Exploit OpenVDB Memory Management] ===> [Buffer Overflow]*** ===> [Out-of-Bounds Read/Write]*** ===> [Code Execution]***

Attack Tree Path: Path 3

[Arbitrary Code Execution on Server]*** ===> [Exploit OpenVDB Parsing/Processing] ===> [Malicious VDB File] ===> [Crafted Data] ===> [Code Execution]***

Attack Tree Path: Path 4

[Arbitrary Code Execution on Server]*** ===> [Exploit OpenVDB Parsing/Processing] ===> [Fuzzing Input] ===> [Oversized Data] ===> [Code Execution]***