CWE-276: Incorrect Default Permissions Incorrect Default Permissions
Weakness ID: 276 (Weakness Variant) Status: Draft
Description
Description Summary
The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor .
Time of Introduction
Architecture and Design
Implementation
Installation
Operation
Common Consequences
Scope Effect Confidentiality
Integrity
Technical Impact: Read application
data; Modify application
data
Likelihood of Exploit
Observed Examples
Reference Description CVE-2005-1941 Executables installed
world-writable. CVE-2002-1713 Home directories installed
world-readable. CVE-2001-1550 World-writable log files allow information loss;
world-readable file has cleartext passwords. CVE-2002-1711 World-readable
directory. CVE-2002-1844 Windows product uses insecure permissions when
installing on Solaris (genesis: port error). CVE-2001-0497 Insecure permissions for a shared secret key file.
Overlaps cryptographic problem. CVE-1999-0426 Default permissions of a device allow IP
spoofing.
Potential Mitigations
Very carefully manage the setting, management and handling of
permissions. Explicitly manage trust zones in the software.
Phase: Architecture and Design
Ensure that appropriate compartmentalization is built into the system
design and that the compartmentalization serves to allow for and further
reinforce privilege separation functionality. Architects and designers
should rely on the principle of least privilege to decide when it is
appropriate to use and to drop system privileges.
Weakness Ordinalities
Ordinality Description Primary
(where
the weakness exists independent of other weaknesses)
Relationships
Causal Nature
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Insecure Default Permissions CERT C Secure Coding FIO06-C Create files with appropriate access
permissions CERT Java Secure Coding FIO03-J Create files with appropriate access
permission CERT C++ Secure Coding FIO06-CPP Create files with appropriate access
permissions
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time_of_Introduction 2008-09-08 CWE Content Team MITRE Internal updated Relationships, Taxonomy_Mappings,
Weakness_Ordinalities 2008-11-24 CWE Content Team MITRE Internal updated Relationships,
Taxonomy_Mappings 2009-05-27 CWE Content Team MITRE Internal updated Description, Name 2011-06-01 CWE Content Team MITRE Internal updated Common_Consequences, Relationships,
Taxonomy_Mappings 2011-09-13 CWE Content Team MITRE Internal updated Relationships,
Taxonomy_Mappings Previous Entry Names Change Date Previous Entry
Name 2009-05-27 Insecure Default
Permissions
Description
