The software does not properly "clean up" and remove temporary
or supporting resources after they have been used.
Alternate Terms
Insufficient Cleanup
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Demonstrative Examples
Example 1
Stream resources in a Java application should be released in a
finally block, otherwise an exception thrown before the call to close()
would result in an unreleased I/O resource. In the example below, the
close() method is called in the try block (incorrect).
(Bad Code)
Java
try {
InputStream is = new FileInputStream(path);
byte b[] = new byte[is.available()];
is.read(b);
is.close();
} catch (Throwable t) {
log.error("Something bad happened: " + t.getMessage());
Users not logged out when application is restarted
after security-relevant changes were made.
Potential Mitigations
Phase
Description
Temporary files and other supporting resources should be
deleted/released immediately after they are no longer needed.
Other Notes
Temporary files should be deleted as soon as possible. If a file contains
sensitive information, the longer it exists the better the chance an
attacker has to gain access to its contents. Also it is possible to overflow
the number of temporary files because directories typically have limits on
the number of files allowed, which could create a denial of service
problem.
Overlaps other categories. Concept needs further development.
This could be primary (e.g. leading to infoleak) or resultant (e.g.
resulting from unhandled error condition or early termination).
Overlaps other categories such as permissions and containment.
CWE-459 is a child of CWE-404 because, while CWE-404 covers any type of
improper shutdown or release of a resource, CWE-459 deals specifically with
a multi-step shutdown process in which a crucial step for "proper" cleanup
is omitted or impossible. That is, CWE-459 deals specifically with a cleanup
or shutdown process that does not successfully remove all potentially
sensitive data.
Functional Areas
File processing
Taxonomy Mappings
Mapped Taxonomy Name
Node ID
Fit
Mapped Node Name
PLOVER
Incomplete Cleanup
OWASP Top Ten 2004
A10
CWE More Specific
Insecure Configuration Management
Content History
Submissions
Submission Date
Submitter
Organization
Source
PLOVER
Externally Mined
Modifications
Modification Date
Modifier
Organization
Source
2008-07-01
Sean Eidemiller
Cigital
External
added/updated demonstrative
examples
2008-07-01
Eric Dalci
Cigital
External
updated Time of Introduction
2008-09-08
CWE Content Team
MITRE
Internal
updated Relationships, Other Notes,
Taxonomy Mappings
Description
