Operator Precedence Logic Error

Opis

The product uses an expression in which operator precedence causes incorrect logic to be used.

While often just a bug, operator precedence logic errors can have serious consequences if they are used in security-critical code, such as making an authentication decision.

Skutki

• Confidentiality, Integrity, Availability

  Varies by Context; Unexpected State

  The consequences will vary based on the context surrounding the incorrect precedence. In a security decision, integrity or confidentiality are the most likely results. Otherwise, a crash may occur due to the software reaching an unexpected state.

Zapobieganie

• Implementation

  Regularly wrap sub-expressions in parentheses, especially in security-critical code.

Przykłady podatności

• CVE-2008-2516 Authentication module allows authentication bypass because it uses "(x = call(args) == SUCCESS)" instead of "((x = call(args)) == SUCCESS)".
• CVE-2008-0599 Chain: Language interpreter calculates wrong buffer size (CWE-131) by using "size = ptr ? X : Y" instead of "size = (ptr ? X : Y)" expression.
• CVE-2001-1155 Chain: product does not properly check the result of a reverse DNS lookup because of operator precedence (CWE-783), allowing bypass of DNS-based access restrictions.

Słabość nadrzędna

• CWE-670 Always-Incorrect Control Flow Implementation

Kiedy powstaje

• Implementation — Logic errors related to operator precedence may cause problems even during normal operation, so they are probably discovered quickly during the testing phase. If testing is incomplete or there is a strong reliance on manual review of the code, then these errors may not be discovered before the software is deployed.

Dotyczy

C, C++, Not Language-Specific

Źródła

1. EXP00-C. Use parentheses for precedence of operation — CERT
2. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 6, "Precedence", Page 287, Addison Wesley, 2006