Symbolic Name not Mapping to Correct Object

Opis

A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.

Skutki

• Access Control

  Gain Privileges or Assume Identity

  The attacker can gain access to otherwise unauthorized resources.

• Integrity, Confidentiality, Other

  Modify Application Data; Modify Files or Directories; Read Application Data; Read Files or Directories; Other

  Race conditions such as this kind may be employed to gain read or write access to resources not normally readable or writable by the user in question.

• Integrity, Other

  Modify Application Data; Other

  The resource in question, or other resources (through the corrupted one) may be changed in undesirable ways by a malicious user.

• Non-Repudiation

  Hide Activities

  If a file or other resource is written in this method, as opposed to a valid way, logging of the activity may not occur.

• Non-Repudiation, Integrity

  Modify Files or Directories

  In some cases it may be possible to delete files that a malicious user might not otherwise have access to -- such as log files.

Słabość nadrzędna

• CWE-706 Use of Incorrectly-Resolved Name or Reference

Pokrewna

• CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
• CWE-610 Externally Controlled Reference to a Resource in Another Sphere
• CWE-486 Comparison of Classes by Name

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005