Transmission of Private Resources into a New Sphere ('Resource Leak')

Opis

The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

Inne nazwy

Resource Leak

Skutki

• Confidentiality

  Read Application Data

Przykłady podatności

• CVE-2003-0740 Server leaks a privileged file descriptor, allowing the server to be hijacked.
• CVE-2004-1033 File descriptor leak allows read of restricted files.

Słabość nadrzędna

• CWE-668 Exposure of Resource to Wrong Sphere

Słabości podrzędne

• CWE-403 Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
• CWE-619 Dangling Database Cursor ('Cursor Injection')

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific