Read Time:1 Minute, 39 Second
Description
The software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
If the drop fails, the software will continue to run with the raised privileges, which might provide additional access to unprivileged users.
In Windows based environments that have access control, impersonation is used so that access checks can be performed on a client identity by a server with higher privileges. By impersonating the client, the server is restricted to client-level security — although in different threads it may have much higher privileges.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit: Medium
Related Weaknesses
CWE-754
CWE-754
CWE-271
CWE-252
Consequences
Access Control: Gain Privileges or Assume Identity
If privileges are not dropped, neither are access rights of the user. Often these rights can be prevented from being dropped.
Access Control, Non-Repudiation: Gain Privileges or Assume Identity, Hide Activities
If privileges are not dropped, in some cases the system may record actions as the user which is being impersonated rather than the impersonator.
Potential Mitigations
Phase: Architecture and Design
Description:
Phase: Implementation
Effectiveness: High
Description:
Check the results of all functions that return a value and verify that the value is expected.
Checking the return value of the function will typically be sufficient, however beware of race conditions (CWE-362) in a concurrent environment.
Phase: Implementation
Description:
In Windows, make sure that the process token has the SeImpersonatePrivilege(Microsoft Server 2003). Code that relies on impersonation for security must ensure that the impersonation succeeded, i.e., that a proper privilege demotion happened.
CVE References
- CVE-2006-4447
- Program does not check return value when invoking functions to drop privileges, which could leave users with higher privileges than expected by forcing those functions to fail.
- CVE-2006-2916
- Program does not check return value when invoking functions to drop privileges, which could leave users with higher privileges than expected by forcing those functions to fail.
