Improper Check or Handling of Exceptional Conditions

Opis

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Skutki

• Confidentiality, Availability, Integrity

  Read Application Data; DoS: Crash, Exit, or Restart; Unexpected State

Przykłady podatności

• CVE-2022-22224 Chain: an operating system does not properly process malformed Open Shortest Path First (OSPF) Type/Length/Value Identifiers (TLV) (CWE-703), which can cause the process to enter an infinite loop (CWE-835)

Słabości podrzędne

• CWE-228 Improper Handling of Syntactically Invalid Structure
• CWE-248 Uncaught Exception
• CWE-391 Unchecked Error Condition
• CWE-392 Missing Report of Error Condition
• CWE-393 Return of Wrong Status Code
• CWE-397 Declaration of Throws for Generic Exception
• CWE-754 Improper Check for Unusual or Exceptional Conditions
• CWE-755 Improper Handling of Exceptional Conditions
• CWE-1384 Improper Handling of Physical or Environmental Conditions

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.
• Operation

Dotyczy

Not Language-Specific, Not Technology-Specific

Uwagi

This is a high-level class that might have some overlap with other classes. It could be argued that even "normal" weaknesses such as buffer overflows involve unusual or exceptional conditions. In that sense, this might be an inherent aspect of most other weaknesses within CWE, similar to API Abuse (CWE-227) and Indicator of Poor Code Quality (CWE-398). However, this entry is currently intended to unify disparate concepts that do not have other places within the Research Concepts view (CWE-1000).

Źródła

1. A Taxonomy of Security Faults in the UNIX Operating System — Taimur Aslam, 1995
2. Use of A Taxonomy of Security Faults — Taimur Aslam, Ivan Krsul, Eugene H. Spafford, 1995
3. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 8: C++ Catastrophes." Page 143, McGraw-Hill, 2010
4. Randstorm: You Can't Patch a House of Cards — Unciphered, 2023
5. State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation — Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy, 2014