Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
Relevant to the view "Research Concepts" (CWE-1000)
Nature
Type
ID
Name
ChildOf
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness.
The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the software life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
Phase
Note
Architecture and Design
Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Applicable Platforms
The listings below show possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.
The table below specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
Scope
Impact
Likelihood
Integrity Other
Technical Impact: Varies by Context; Unexpected State; Alter Execution Logic
Likelihood Of Exploit
Medium
Demonstrative Examples
Example 1
The following code excerpt ignores a rarely-thrown exception from doExchange().
(bad code)
Example Language: Java
try {
doExchange();
} catch (RareException e) {
// this can never happen
}
If a RareException were to ever be thrown, the program would continue to execute as though nothing unusual had occurred. The program records no evidence indicating the special situation, potentially frustrating any later attempt to explain the program's behavior.
Potential Mitigations
Phase: Requirements
The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.
Phase: Requirements
A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.
Phase: Implementation
Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
Nature
Type
ID
Name
MemberOf
Category - a CWE entry that contains a set of other entries that share a common characteristic.
This entry needs significant modification. It currently combines information from three different taxonomies, but each taxonomy is talking about a slightly different issue.
Other
When a programmer ignores an exception, they implicitly state that they are operating under one of two assumptions:
This method call can never fail.
It doesn't matter if this call fails.
Taxonomy Mappings
Mapped Taxonomy Name
Node ID
Fit
Mapped Node Name
PLOVER
Unchecked Return Value
7 Pernicious Kingdoms
Empty Catch Block
CLASP
Uncaught exception
OWASP Top Ten 2004
A7
CWE More Specific
Improper Error Handling
CERT C Secure Coding
ERR00-C
Adopt and implement a consistent and comprehensive error-handling policy
CERT C Secure Coding
ERR33-C
CWE More Abstract
Detect and handle standard library errors
CERT C Secure Coding
ERR34-C
CWE More Abstract
Detect errors when converting a string to a number
CERT C Secure Coding
FLP32-C
Imprecise
Prevent or detect domain and range errors in math functions
More information is available — Please select a different filter.
Page Last Updated:
March 29, 2018
Use of the Common Weakness Enumeration and the associated references from this website are subject to the
Terms of Use. For more information, please email
cwe@mitre.org.
Description
Relevant to the view "Research Concepts" (CWE-1000)
