Improper Privilege Management

Opis

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Skutki

• Access Control

  Gain Privileges or Assume Identity

Zapobieganie

• Architecture and Design, Operation

  Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

• Architecture and Design · Separation of Privilege

  Follow the principle of least privilege when assigning access rights to entities in a software system.

• Architecture and Design · Separation of Privilege

  Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

Przykłady podatności

• CVE-2001-1555 Terminal privileges are not reset when a user logs out.
• CVE-2001-1514 Does not properly pass security context to child processes in certain cases, allows privilege escalation.
• CVE-2001-0128 Does not properly compute roles.
• CVE-1999-1193 untrusted user placed in unix "wheel" group
• CVE-2005-2741 Product allows users to grant themselves certain rights that can be used to escalate privileges.
• CVE-2005-2496 Product uses group ID of a user instead of the group, causing it to run with different privileges. This is resultant from some other unknown issue.
• CVE-2004-0274 Product mistakenly assigns a particular status to an entity, leading to increased privileges.
• CVE-2007-4217 FTP client program on a certain OS runs with setuid privileges and has a buffer overflow. Most clients do not need extra privileges, so an overflow is not a vulnerability for those clients.
• CVE-2007-5159 OS incorrectly installs a program with setuid privileges, allowing users to gain privileges.
• CVE-2008-4638 Composite: application running with high privileges (CWE-250) allows user to specify a restricted file to process, which generates a parsing error that leaks the contents of the file (CWE-209).
• CVE-2007-3931 Installation script installs some programs as setuid when they shouldn't be.
• CVE-2002-1981 Roles have access to dangerous procedures (Accessible entities).
• CVE-2002-1671 Untrusted object/method gets access to clipboard (Accessible entities).
• CVE-2000-0315 Traceroute program allows unprivileged users to modify source address of packet (Accessible entities).
• CVE-2000-0506 User with capability can prevent setuid program from dropping privileges (Unsafe privileged actions).

Słabość nadrzędna

• CWE-284 Improper Access Control

Słabości podrzędne

• CWE-250 Execution with Unnecessary Privileges
• CWE-266 Incorrect Privilege Assignment
• CWE-267 Privilege Defined With Unsafe Actions
• CWE-268 Privilege Chaining
• CWE-270 Privilege Context Switching Error
• CWE-271 Privilege Dropping / Lowering Errors
• CWE-274 Improper Handling of Insufficient Privileges
• CWE-648 Incorrect Use of Privileged APIs

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.
• Operation

Dotyczy

Not Language-Specific

Uwagi

The relationships between privileges, permissions, and actors (e.g. users and groups) need further refinement within the Research view. One complication is that these concepts apply to two different pillars, related to control of resources (CWE-664) and protection mechanism failures (CWE-693).

Źródła

1. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 16: Executing Code With Too Much Privilege." Page 243, McGraw-Hill, 2010
2. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 9, "Dropping Privileges Permanently", Page 479, Addison Wesley, 2006
3. Supplemental Details - 2022 CWE Top 25 — MITRE, Details of Problematic Mappings, 2022