The software does not drop privileges before passing control of
a resource to an actor that does not have those
privileges.
Extended Description
In some contexts, a system executing with elevated permissions will hand
off a process/file/etc. to another process or user. If the privileges of an
entity are not reduced, then elevated privileges are spread throughout a
system and possibly to an attacker.
Windows program running as SYSTEM does not drop
privileges before executing other programs (many others like this,
especially involving the Help facility).
Service on Windows does not drop privileges before
using "view file" option, allowing code
execution.
Potential Mitigations
ID
Phase
Description
Architecture and Design
Ensure that appropriate compartmentalization is built into the system
design and that the compartmentalization serves to allow for and further
reinforce privilege separation functionality. Architects and designers
should rely on the principle of least privilege to decide when it is
appropriate to use and to drop system privileges.
1
Very carefully manage the setting, management and handling of
privileges. Explicitly manage trust zones in the software.
Consider following the principle of separation of privilege. Require
multiple conditions to be met before permitting access to a system
resource.
Weakness Ordinalities
Ordinality
Description
Primary
(where the
weakness exists independent of other weaknesses)
Description
