CWE-375
Returning a Mutable Object to an Untrusted Caller
2006-07-19
00h00 +00:00
00h00 +00:00
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
名前: Returning a Mutable Object to an Untrusted Caller
The code sends non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
一般情報
導入モード
Implementation適用可能なプラットフォーム
言語
クラス： Object-Oriented (Undetermined)名前： C (Undetermined)
名前： C++ (Undetermined)
名前： Java (Undetermined)
名前： C# (Undetermined)
一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Access Control Integrity | Modify Memory 注記：The muitable data could be altered or deleted by the calling function. If this data was not previously cloned, the class will then be using modified data which may violate assumptions about its internal state. |
潜在的な緩和策
Phases : ImplementationDeclare returned data which should not be altered as constant or immutable.
Phases : Implementation
Clone all mutable data before returning references to it. This is the preferred mitigation. This way, regardless of what changes are made to the data, a valid copy is retained for use by the class.
脆弱性マッピングノート
理由 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
参考文献
REF-18
The CLASP Application Security ProcessSecure Software, Inc..
https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| CLASP | Draft 3 |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Name, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Description, Other_Notes, Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated References | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description |
