CWE-283 未经验证的属主

Unverified Ownership

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The software does not properly verify that a critical resource is owned by the proper entity.

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
Access Control	Gain Privileges or Assume Identity	An attacker could gain unauthorized access to system resources.

可能的缓解方案

MIT-1 ['Architecture and Design', 'Operation']

策略:

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

MIT-49 Architecture and Design

策略: Separation of Privilege

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

示例代码

例

This function is part of a privileged program that takes input from users with potentially lower privileges.

bad Python

def killProcess(processID):

os.kill(processID, signal.SIGKILL)

This code does not confirm that the process to be killed is owned by the requesting user, thus allowing an attacker to kill arbitrary processes.

This function remedies the problem by checking the owner of the process before killing it:

good Python

def killProcess(processID):

user = getCurrentUser()

#Check process owner against requesting user
if getProcessOwner(processID) == user:

os.kill(processID, signal.SIGKILL)
return

else:

print("You cannot kill a process you don't own")
return

分析过的案例

标识	说明	链接
CVE-2001-0178	Program does not verify the owner of a UNIX socket that is used for sending a password.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0178
CVE-2004-2012	Owner of special device not checked, allowing root.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2012

Notes

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
PLOVER			Unverified Ownership

VULHUB ™