The software does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error, which can cause the software to execute in a less secure fashion than intended by the administrator.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Integrity
Other
Technical Impact: Modify application
data; Alter execution
logic
Product does not trigger a fatal error if missing
or invalid ACLs are in a configuration file.
Potential Mitigations
Follow the principle of failing securely when an error occurs. The
system should enter a state where it is not vulnerable and will not
display sensitive error messages to a potential attacker.
Description
