Improper Ownership Management

Opis

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

Skutki

• Access Control

  Gain Privileges or Assume Identity

Zapobieganie

• Architecture and Design, Operation

  Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Przykłady podatności

• CVE-1999-1125 Program runs setuid root but relies on a configuration file owned by a non-root user.

Słabość nadrzędna

• CWE-284 Improper Access Control

Słabości podrzędne

• CWE-283 Unverified Ownership
• CWE-708 Incorrect Ownership Assignment

Kiedy powstaje

• Architecture and Design — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific

Uwagi

The relationships between privileges, permissions, and actors (e.g. users and groups) need further refinement within the Research view. One complication is that these concepts apply to two different pillars, related to control of resources (CWE-664) and protection mechanism failures (CWE-693).