Unverified Ownership

Opis

The product does not properly verify that a critical resource is owned by the proper entity.

Skutki

• Access Control

  Gain Privileges or Assume Identity

  An attacker could gain unauthorized access to system resources.

Zapobieganie

• Architecture and Design, Operation

  Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

• Architecture and Design · Separation of Privilege

  Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

Przykłady podatności

• CVE-2001-0178 Program does not verify the owner of a UNIX socket that is used for sending a password.
• CVE-2004-2012 Owner of special device not checked, allowing root.

Słabość nadrzędna

• CWE-282 Improper Ownership Management

Kiedy powstaje

• Architecture and Design — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific

Uwagi

This overlaps insufficient comparison, verification errors, permissions, and privileges.