Error Conditions, Return Values, Status Codes

Opis

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

Wpisy w tej grupie

• CWE-209 Generation of Error Message Containing Sensitive Information
• CWE-248 Uncaught Exception
• CWE-252 Unchecked Return Value
• CWE-253 Incorrect Check of Function Return Value
• CWE-390 Detection of Error Condition Without Action
• CWE-391 Unchecked Error Condition
• CWE-392 Missing Report of Error Condition
• CWE-393 Return of Wrong Status Code
• CWE-394 Unexpected Status Code or Return Value
• CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference
• CWE-396 Declaration of Catch for Generic Exception
• CWE-397 Declaration of Throws for Generic Exception
• CWE-544 Missing Standardized Error Handling Mechanism
• CWE-584 Return Inside Finally Block
• CWE-617 Reachable Assertion
• CWE-756 Missing Custom Error Page

Uwagi

Many researchers focus on the resultant weaknesses and do not necessarily diagnose whether a rare condition is the primary factor. However, since 2005 it seems to be reported more frequently than in the past. This subject needs more study.

Źródła