Read Time:1 Minute, 18 Second
Description
The software does not properly “clean up” and remove temporary or supporting resources after they have been used.
Modes of Introduction:
– Architecture and Design
Related Weaknesses
CWE-404
CWE-404
Consequences
Other, Confidentiality, Integrity: Other, Read Application Data, Modify Application Data, DoS: Resource Consumption (Other)
It is possible to overflow the number of temporary files because directories typically have limits on the number of files allowed. This could create a denial of service problem.
Potential Mitigations
Phase: Architecture and Design, Implementation
Description:
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
CVE References
- CVE-2000-0552
- World-readable temporary file not deleted after use.
- CVE-2005-2293
- Temporary file not deleted after use, leaking database usernames and passwords.
- CVE-2002-0788
- Interaction error creates a temporary file that can not be deleted due to strong permissions.
- CVE-2002-2066
- Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
- CVE-2002-2067
- Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
- CVE-2002-2068
- Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
- CVE-2002-2069
- Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
- CVE-2002-2070
- Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
- CVE-2005-1744
- Users not logged out when application is restarted after security-relevant changes were made.
