Description
The software does not properly verify that a critical resource is owned by the proper entity.
Modes of Introduction:
– Architecture and Design
Related Weaknesses
CWE-282
Consequences
Access Control: Gain Privileges or Assume Identity
An attacker could gain unauthorized access to system resources.
Potential Mitigations
Phase: Architecture and Design, Operation
Description:
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Phase: Architecture and Design
Description:
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CVE References
- CVE-2001-0178
- Program does not verify the owner of a UNIX socket that is used for sending a password.
- CVE-2004-2012
- Owner of special device not checked, allowing root.
