CWE-913
Improper Control of Dynamically-Managed Code Resources
2013-02-21
00h00 +00:00
00h00 +00:00
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
名前: Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
一般情報
背景の詳細
導入モード
Architecture and DesignImplementation
適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)クラス： Interpreted (Undetermined)
一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Integrity | Execute Unauthorized Code or Commands | |
| Other Integrity | Varies by Context, Alter Execution Logic |
観察された例
| 参考文献 | 説明 |
|---|---|
CVE-2022-2054 | Python compiler uses eval() to execute malicious strings as Python code. |
CVE-2018-1000613 | Cryptography API uses unsafe reflection when deserializing a private key |
CVE-2015-8103 | Deserialization issue in commonly-used Java library allows remote execution. |
CVE-2006-7079 | Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22) |
CVE-2012-2055 | Source version control product allows modification of trusted key using mass assignment. |
潜在的な緩和策
Phases : ImplementationFor any externally-influenced input, check the input against an allowlist of acceptable values.
Phases : Implementation // Architecture and Design
Refactor the code so that it does not need to be dynamically managed.
検出方法
Fuzzing
Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption, or resource consumption. Fuzzing effectively produces repeatable test cases that clearly indicate bugs, which helps developers to diagnose the issues.有効性 : High
脆弱性マッピングノート
理由 : This CWE entry is a Class and might have Base-level children that would be more appropriateコメント : Examine children of this entry to see if there is a better fit
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 2.4 |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Detection_Factors, Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Demonstrative_Examples, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Background_Details, Description |
