Self-generated Error Message Containing Sensitive Information

Opis

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

Skutki

• Confidentiality

  Read Application Data

Zapobieganie

• Implementation, Build and Compilation · Compilation or Build Hardening

  Debugging information should not make its way into a production release.

• Implementation, Build and Compilation · Environment Hardening

  Debugging information should not make its way into a production release.

Przykłady podatności

• CVE-2005-1745 Infoleak of sensitive information in error message (physical access required).

Słabość nadrzędna

• CWE-209 Generation of Error Message Containing Sensitive Information

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific

Źródła

1. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 12: Information Leakage." Page 191, McGraw-Hill, 2010
2. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 3, "Overly Verbose Error Messages", Page 75, Addison Wesley, 2006