Detalle CWE-703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Modos de introducción

Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation

Plataformas aplicables

Lenguaje

Class: Not Language-Specific (Undetermined)

Tecnologías

Class: Not Technology-Specific (Undetermined)

Consecuencias comunes

Ejemplos observados

Métodos de detección

Dynamic Analysis with Manual Results Interpretation

Efectividad : High

Manual Static Analysis - Source Code

Efectividad : High

Automated Static Analysis - Source Code

Efectividad : SOAR Partial

Architecture or Design Review

Efectividad : High

Notas de mapeo de vulnerabilidades

Justificación : This CWE entry is extremely high-level, a Pillar.
Comentario : Consider children or descendants of this entry instead.

Notas

This is a high-level class that might have some overlap with other classes. It could be argued that even "normal" weaknesses such as buffer overflows involve unusual or exceptional conditions. In that sense, this might be an inherent aspect of most other weaknesses within CWE, similar to API Abuse (CWE-227) and Indicator of Poor Code Quality (CWE-398). However, this entry is currently intended to unify disparate concepts that do not have other places within the Research Concepts view (CWE-1000).

Referencias

REF-567

A Taxonomy of Security Faults in the UNIX Operating System
Taimur Aslam.
http://ftp.cerias.purdue.edu/pub/papers/taimur-aslam/aslam-taxonomy-msthesis.pdf

REF-568

Use of A Taxonomy of Security Faults
Taimur Aslam, Ivan Krsul, Eugene H. Spafford.
https://csrc.nist.gov/csrc/media/publications/conference-paper/1996/10/22/proceedings-of-the-19th-nissc-1996/documents/paper057/paper.pdf

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

REF-1374

Randstorm: You Can't Patch a House of Cards
Unciphered.
https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/

REF-1479

State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx

Envío

Modificaciones