The code does not have a default case in a switch statement,
which might lead to complex logical errors and resultant
weaknesses.
Time of Introduction
Implementation
Applicable Platforms
Languages
C
C++
Java
.NET
Common Consequences
Scope
Effect
Other
Depending on the logical circumstances involved, any consequences may
result: e.g., issues of confidentiality, authentication, authorization,
availability, integrity, accountability, or non-repudiation.
Demonstrative Examples
Example 1
The following fails to properly check the return code in the case
where the security_check function returns a -1 value when an error occurs.
If an attacker can supply data that will invoke an error, the attacker can
bypass the security check:
(Bad Code)
C
#define FAILED 0
#define PASSED 1
int result;
...
result = security_check(data);
switch (result) {
case FAILED:
printf("Security check failed!\n");
exit(-1);
case PASSED:
printf("Security check passed.\n");
break;
}
// program execution continues...
...
Instead a default label should be used for unaccounted
conditions:
This label is used because the assumption cannot be made that all
possible cases are accounted for. A good practice is to reserve the
default case for error handling.
Potential Mitigations
Phase
Description
Implementation
Ensure that there are no unaccounted for cases, when adjusting flow or
values based on the value of a given variable. In switch statements,
this can be accomplished through the use of the default label.
Other Notes
This flaw represents a common problem in software development, in which
not all possible values for a variable are considered or handled by a given
process. Because of this, further decisions are made based on poor
information, and cascading failure results. This cascading failure may
result in any number of security issues, and constitutes a significant
failure in the system. In the case of switch style statements, the very
simple act of creating a default case can mitigate this situation, if done
correctly. Often however, the default cause is used simply to represent an
assumed option, as opposed to working as a sanity check. This is poor
practice and in some cases is as bad as omitting a default case entirely.
Weakness Ordinalities
Ordinality
Description
Primary
(where the
weakness exists independent of other weaknesses)
Description
