Privilege Issues

Opis

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

Wpisy w tej grupie

• CWE-243 Creation of chroot Jail Without Changing Working Directory
• CWE-250 Execution with Unnecessary Privileges
• CWE-266 Incorrect Privilege Assignment
• CWE-267 Privilege Defined With Unsafe Actions
• CWE-268 Privilege Chaining
• CWE-270 Privilege Context Switching Error
• CWE-272 Least Privilege Violation
• CWE-273 Improper Check for Dropped Privileges
• CWE-274 Improper Handling of Insufficient Privileges
• CWE-280 Improper Handling of Insufficient Permissions or Privileges
• CWE-501 Trust Boundary Violation
• CWE-580 clone() Method Without super.clone()
• CWE-648 Incorrect Use of Privileged APIs

Uwagi

This can strongly overlap authorization errors.

A sandbox could be regarded as an explicitly defined sphere of control, in that the sandbox only defines a limited set of behaviors, which can only access a limited set of resources.

It could be argued that any privilege problem occurs within the context of a sandbox.

Many of the following concepts require deeper study. Most privilege problems are not classified at such a low level of detail, and terminology is very sparse. Certain classes of software, such as web browsers and software bug trackers, provide a rich set of examples for further research. Operating systems have matured to the point that these kinds of weaknesses are rare, but finer-grained models for privileges, capabilities, or roles might introduce subtler issues.