CWE - CWE-71: Apple '.DS

Home > CWE List > CWE- Individual Dictionary Definition (1.1)

CWE List
Full Dictionary View
Development View
Research View
Reports

About
Sources
Process
Documents

Community
Related Activities
Discussion List
Research
CWSS

News
Calendar
Free Newsletter

Compatibility
Program
Requirements
Declarations
Make a Declaration

Contact Us
Search the Site

CWE-71: Apple '.DS_Store'

Individual Definition in a New Window

Apple '.DS Store'

Status: Incomplete

Weakness ID: 71 (Weakness Variant)

Description

Summary

Software operating in a MAC OS environment, where .DS_Store is in effect, must carefully manage hard links, otherwise an attacker may be able to leverage a hard link from .DS_Store to overwrite arbitrary files and gain privileges.

Observed Examples

Reference	Description
BUGTRAQ:20010910	More security problems in Apache on Mac OS X
CVE-2005-0342	The Finder in Mac OS X and earlier allows local users to overwrite arbitrary files and gain privileges by creating a hard link from the .DS_Store file to an arbitrary file.

Research Gaps

Under-studied

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Category	70	Mac Virtual File Problems	Resource-specific Weaknesses (primary)631 Development Concepts (primary)699
ChildOf	Weakness Base	66	Failure to Handle File Names that Identify Virtual Resources	Research Concepts (primary)1000
PeerOf	Weakness Variant	62	UNIX Hard Link	Research Concepts1000

Taxonomy Mappings

Mapped Taxonomy Name	Mapped Node Name
PLOVER	DS - Apple '.DS_Store

Applicable Platforms

Languages

All

Time of Introduction

Architecture and Design

Implementation

Operation

Maintenance Notes

This entry, which originated from PLOVER, probably stems from a common manipulation that is used to exploit symlink and hard link following weaknesses, like /etc/passwd is often used for UNIX-based exploits. As such, it is probably too low-level for inclusion in CWE.

Content History

Submissions

PLOVER. (Externally Mined)

Modifications

Eric Dalci. Cigital. 2008-07-01. (External)

updated Time_of_Introduction

CWE Content Team. MITRE. 2008-09-08. (Internal)

updated Relationships, Taxonomy_Mappings

CWE Content Team. MITRE. 2008-10-14. (Internal)

updated Maintenance_Notes

Page Last Updated: November 24, 2008


	CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is hosted by The MITRE Corporation. Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information.	Privacy policy Terms of use Contact us