CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.1)  
Search by ID:

CWE-689: Permission Race Condition During Resource Copy

Individual Definition in a New Window
Permission Race Condition During Resource Copy
Status: Draft
Compound Element ID: 689 (Compound Element Base: Composite)
Description
Summary

The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place.

Weakness Ordinalities
Primary (where the weakness exists independent of other weaknesses)
Observed Examples
ReferenceDescription
Archive extractor decompresses files with world-readable permissions, then later sets permissions to what the archive specified.
database product creates files world-writable before initializing the setuid bits, leading to modification of executables.
Product inserts a new object into database before setting the object's permissions, introducing a race condition.
Archive permissions issue using hard link.
error file has weak permissions before a chmod is performed.
Other Notes

This is a general issue, although few subtypes are currently known. The most common examples occur in file archive extraction, in which the product begins the extraction with insecure default permissions, then only sets the final permissions (as specified in the archive) once the copy is complete. The larger the archive, the larger the timing window for the race condition. This weakness has also occurred in some operating system utilities that perform copies of deeply nested directories containing a large number of files.

Research Gaps

Under-studied. It seems likely that this weakness could occur in any situation in which a complex or large copy operation occurs, when the resource can be made available to other spheres as soon as it is created, but before its initialization is complete.

Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory275Permission Issues
Development Concepts (primary)699
ChildOfWeakness ClassWeakness ClassWeakness Class668Exposure of Resource to Wrong Sphere
Research Concepts (primary)1000
RequiresWeakness ClassWeakness ClassWeakness Class362Race Condition
Research Concepts1000
RequiresWeakness ClassWeakness ClassWeakness Class732Insecure Permission Assignment for Resource
Research Concepts1000
Applicable Platforms
Languages
C
Perl
Time of Introduction
* Implementation
Content History
Modifications
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Applicable_Platforms, Relationships, Other_Notes, Weakness_Ordinalities
Back to top
Page Last Updated: November 24, 2008
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us