Obscured Security-relevant Information by Alternate Name

Opis

The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.

Skutki

• Non-Repudiation, Access Control

  Hide Activities; Gain Privileges or Assume Identity

Przykłady podatności

• CVE-2002-0725 Attacker performs malicious actions on a hard link to a file, obscuring the real target file.

Słabość nadrzędna

• CWE-221 Information Loss or Omission

Kiedy powstaje

• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.
• Operation

Dotyczy

Not Language-Specific

Źródła

1. Writing Secure Code — Michael Howard, David LeBlanc, Microsoft Press, 2002