名前: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
一般情報
導入モード
Implementation適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)名前： Python (Undetermined)
一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Other Confidentiality Integrity | Other, Read Application Data, Modify Application Data, DoS: Resource Consumption (Other) 注記：It is possible to overflow the number of temporary files because directories typically have limits on the number of files allowed. This could create a denial of service problem. |
観察された例
| 参考文献 | 説明 |
|---|---|
CVE-2000-0552 | World-readable temporary file not deleted after use. |
CVE-2005-2293 | Temporary file not deleted after use, leaking database usernames and passwords. |
CVE-2002-0788 | Interaction error creates a temporary file that can not be deleted due to strong permissions. |
CVE-2002-2066 | Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak). |
CVE-2002-2067 | Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak). |
CVE-2002-2068 | Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak). |
CVE-2002-2069 | Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak). |
CVE-2002-2070 | Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak). |
CVE-2005-1744 | Users not logged out when application is restarted after security-relevant changes were made. |
潜在的な緩和策
Phases : Architecture and Design // ImplementationTemporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
検出方法
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)有効性 : High
脆弱性マッピングノート
理由 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
ノート
CWE-459 is a child of CWE-404 because, while CWE-404 covers any type of improper shutdown or release of a resource, CWE-459 deals specifically with a multi-step shutdown process in which a crucial step for "proper" cleanup is omitted or impossible. That is, CWE-459 deals specifically with a cleanup or shutdown process that does not successfully remove all potentially sensitive data.Overlaps other categories such as permissions and containment. Concept needs further development. This could be primary (e.g. leading to infoleak) or resultant (e.g. resulting from unhandled error conditions or early termination).
参考文献
REF-1534
Automated Technical Debt Measure, Version 2OMG.
https://www.omg.org/spec/ATDM2/1.0/PDF
REF-1541
Secure Coding Guide for PythonOpenSSF.
https://best.openssf.org/Secure-Coding-Guide-for-Python/
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| Sean Eidemiller | Cigital | added/updated demonstrative examples | |
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationship_Notes, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences, Other_Notes, Relationship_Notes | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Detection_Factors, Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Applicable_Platforms, References, Relationships, Taxonomy_Mappings |
