CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO)

Opis

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

Wpisy w tej grupie

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-134 Use of Externally-Controlled Format String
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-241 Improper Handling of Unexpected Data Type
• CWE-276 Incorrect Default Permissions
• CWE-279 Incorrect Execution-Assigned Permissions
• CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
• CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
• CWE-37 Path Traversal: '/absolute/pathname/here'
• CWE-379 Creation of Temporary File in Directory with Insecure Permissions
• CWE-38 Path Traversal: '\absolute\pathname\here'
• CWE-39 Path Traversal: 'C:dirname'
• CWE-391 Unchecked Error Condition
• CWE-403 Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
• CWE-404 Improper Resource Shutdown or Release
• CWE-41 Improper Resolution of Path Equivalence
• CWE-552 Files or Directories Accessible to External Parties
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• CWE-62 UNIX Hard Link
• CWE-64 Windows Shortcut Following (.LNK)
• CWE-65 Windows Hard Link
• CWE-67 Improper Handling of Windows Device Names
• CWE-675 Multiple Operations on Resource in Single-Operation Context
• CWE-676 Use of Potentially Dangerous Function
• CWE-686 Function Call With Incorrect Argument Type
• CWE-732 Incorrect Permission Assignment for Critical Resource

Uwagi

<xhtml:p>In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:</xhtml:p> <xhtml:ul> <xhtml:li>CWE-22 FIO02-C Canonicalize path names originating from untrusted sources</xhtml:li> <xhtml:li>CWE-37 FIO05-C Identify files using multiple file attributes</xhtml:li> <xhtml:li>CWE-38 FIO05-C Identify files using multiple file attributes</xhtml:li> <xhtml:li>CWE-39 FIO05-C Identify files using multiple file attributes</xhtml:li> <xhtml:li>CWE-41 FIO02-C Canonicalize path names originating from untrusted sources</xhtml:li> <xhtml:li>CWE-59 FIO02-C Canonicalize path names originating from untrusted sources</xhtml:li> <xhtml:li>CWE-62 FIO05-C Identify files using multiple file attributes</xhtml:li> <xhtml:li>CWE-64 FIO05-C Identify files using multiple file attributes</xhtml:li> <xhtml:li>CWE-65 FIO05-C Identify files using multiple file attributes</xhtml:li> <xhtml:li>CWE-67 FIO32-C Do not perform operations on devices that are only appropriate for files</xhtml:li> <xhtml:li>CWE-119 FIO37-C Do not assume character data has been read</xhtml:li> <xhtml:li>CWE-134 FIO30-C Exclude user input from format strings</xhtml:li> <xhtml:li>CWE-134 FIO30-C Exclude user input from format strings</xhtml:li> <xhtml:li>CWE-241 FIO37-C Do not assume character data has been read</xhtml:li> <xhtml:li>CWE-276 FIO06-C Create files with appropriate access permissions</xhtml:li> <xhtml:li>CWE-279 FIO06-C Create files with appropriate access permissions</xhtml:li> <xhtml:li>CWE-362 FIO31-C Do not simultaneously open the same file multiple times</xhtml:li> <xhtml:li>CWE-367 FIO01-C Be careful using functions that use file names for identification</xhtml:li> <xhtml:li>CWE-379 FIO15-C Ensure that file operations are performed in a secure directory</xhtml:li> <xhtml:li>CWE-379 FIO43-C Do not create temporary files in shared directories</xhtml:li> <xhtml:li>CWE-391 FIO04-C Detect and handle input and output errors</xhtml:li> <xhtml:li>CWE-391 FIO33-C Detect and handle input output errors resulting in undefined behavior</xhtml:li> <xhtml:li>CWE-403 FIO42-C Ensure files are properly closed when they are no longer needed</xhtml:li> <xhtml:li>CWE-404 FIO42-C Ensure files are properly closed when they are no longer needed</xhtml:li> <xhtml:li>CWE-552 FIO15-C Ensure that file operations are performed in a secure directory</xhtml:li> <xhtml:li>CWE-675 FIO31-C Do not simultaneously open the same file multiple times</xhtml:li> <xhtml:li>CWE-676 FIO01-C Be careful using functions that use file names for identification</xhtml:li> <xhtml:li>CWE-686 FIO00-C Take care when creating format strings</xhtml:li> <xhtml:li>CWE-732 FIO06-C Create files with appropriate access permissions</xhtml:li> </xhtml:ul>

Źródła