CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.6)  

CWE-212: Cross-boundary Cleansing Information Leak

 
Cross-boundary Cleansing Information Leak
Weakness ID: 212 (Weakness Base)Status: Incomplete
+ Description

Description Summary

The software does not properly remove sensitive data from a source when preparing it for, or transferring it to, an untrusted destination.

Extended Description

An example of a cross-boundary cleansing information leak would be if an internal IP address might be discovered. This discloses information about the IP addressing scheme of the internal network and can be valuable to attackers.

An example of a cross-boundary cleansing information leak would be if an internal IP address might be discovered. The leak discloses information about the IP addressing scheme of the internal network and can be valuable to attackers. Another example would be features in software that export or copy documents without removing sensitive information such as edit history in a Word and PDF.

+ Time of Introduction
  • Architecture and Design
  • Implementation
  • Operation
+ Applicable Platforms

Languages

All

+ Observed Examples
ReferenceDescription
CVE-2005-0406Some image editors modify a JPEG image, but the original EXIF thumbnail image intact within the JPEG. (Also an interaction error).
CVE-2002-0704NAT feature in firewall leaks internal IP addresses in ICMP error messages.
+ Potential Mitigations
PhaseDescription

Compartmentalize your system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness Class200Information Leak (Information Disclosure)
Development Concepts (primary)699
Research Concepts (primary)1000
CanAlsoBeWeakness BaseWeakness Base226Sensitive Information Uncleared Before Release
Research Concepts1000
+ Relationship Notes

This entry is intended to be different from resultant information leaks, including those that occur from improper buffer initialization and reuse, interaction errors, and multiple interpretation errors. This entry could be regarded as a privacy leak.

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERCross-Boundary Cleansing Infoleak
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Relationships, Other Notes, Taxonomy Mappings
2008-10-14CWE Content TeamMITREInternal
updated Description
2009-10-29CWE Content TeamMITREInternal
updated Description, Other Notes, Relationship Notes
Page Last Updated: October 29, 2009