CWE-224: Obscured Security-relevant Information by Alternate Name
Weakness ID: 224
Abstraction: Base
Status: Incomplete
Presentation Filter:
Description
Description Summary
The software records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.
Time of Introduction
Architecture and Design
Implementation
Operation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Non-Repudiation
Access Control
Technical Impact: Hide activities; Gain privileges / assume
identity
Demonstrative Examples
Example 1
This code prints the contents of a file if a user has permission.
(Bad Code)
Example
Language: PHP
function readFile($filename){
$user = getCurrentUser();
$realFile = $filename;
//resolve file if its a symbolic link
if(is_link($filename)){
$realFile = readlink($filename);
}
if(fileowner($realFile) == $user){
echo file_get_contents($realFile);
return;
}
else{
echo 'Access denied';
writeLog($user . ' attempted to access the file '.
$filename . ' on '. date('r'));
}
}
While the code logs a bad access attempt, it logs the user supplied name for the file, not the canonicalized file name. An attacker can obscure his target by giving the script the name of a link to the file he is attempting to access. Also note this code contains a race condition between the is_link() and readlink() functions (CWE-363).
Obscured Security-relevant Information by Alternate
Name
References
[REF-11] M. Howard and
D. LeBlanc. "Writing Secure Code". 2nd Edition. Microsoft. 2002.
Content History
Submissions
Submission Date
Submitter
Organization
Source
PLOVER
Externally Mined
Modifications
Modification Date
Modifier
Organization
Source
2008-07-01
Eric Dalci
Cigital
External
updated Time_of_Introduction
2008-09-08
CWE Content Team
MITRE
Internal
updated Relationships,
Taxonomy_Mappings
2011-03-29
CWE Content Team
MITRE
Internal
updated Demonstrative_Examples
2011-06-01
CWE Content Team
MITRE
Internal
updated Common_Consequences
2012-05-11
CWE Content Team
MITRE
Internal
updated References, Relationships
2012-10-30
CWE Content Team
MITRE
Internal
updated Potential_Mitigations
2014-07-30
CWE Content Team
MITRE
Internal
updated Relationships
More information is available — Please select a different filter.
Page Last Updated:
May 05, 2017
Use of the Common Weakness Enumeration and the associated references from this website are subject to the
Terms of Use. For more information, please email
cwe@mitre.org.
Description
