CWE-459 – Incomplete Cleanup

Read Time:1 Minute, 18 Second

Description

The software does not properly “clean up” and remove temporary or supporting resources after they have been used.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-404
CWE-404

 

Consequences

Other, Confidentiality, Integrity: Other, Read Application Data, Modify Application Data, DoS: Resource Consumption (Other)

It is possible to overflow the number of temporary files because directories typically have limits on the number of files allowed. This could create a denial of service problem.

 

Potential Mitigations

Phase: Architecture and Design, Implementation

Description: 

Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.

CVE References

  • CVE-2000-0552
    • World-readable temporary file not deleted after use.
  • CVE-2005-2293
    • Temporary file not deleted after use, leaking database usernames and passwords.
  • CVE-2002-0788
    • Interaction error creates a temporary file that can not be deleted due to strong permissions.
  • CVE-2002-2066
    • Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
  • CVE-2002-2067
    • Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
  • CVE-2002-2068
    • Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
  • CVE-2002-2069
    • Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
  • CVE-2002-2070
    • Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
  • CVE-2005-1744
    • Users not logged out when application is restarted after security-relevant changes were made.