이름: Improper Handling of Apple HFS+ Alternate Data Stream Path

The product does not properly handle special paths that may identify the data or resource fork of a file on the HFS+ file system.

일반 정보

배경 세부 정보

취약점 도입 방식

Implementation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

운영 체제

클래스: macOS (Undetermined)

일반적인 결과

범위	영향	가능성
Confidentiality Integrity	Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism 참고: If the product chooses actions to take based on the file name, then if an attacker provides the data or resource fork, the product may take unexpected actions. Further, if the product intends to restrict access to a file, then an attacker might still be able to bypass intended access restrictions by requesting the data or resource fork for that file.

관찰된 예시

참고 자료	설명
CVE-2004-1084	Server allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+.

취약점 매핑 메모

근거 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

메모

This and similar problems exist because the same resource can have multiple identifiers that dictate which behavior can be performed on the resource.
Under-studied

참고 자료

REF-578

NetSec Security Advisory: Multiple Vulnerabilities Resulting From Use Of Apple OSX HFS+
NetSec.
https://seclists.org/bugtraq/2005/Feb/309

제출

이름	조직	날짜	출시일	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

수정 사항

이름	조직	날짜	댓글
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Relationships, Other_Notes, Taxonomy_Mappings
David Remahl	Apple	2008-11-05 +00:00	clarified description, provided background details, and added demonstrative example
CWE Content Team	MITRE	2008-11-24 +00:00	updated Applicable_Platforms, Background_Details, Demonstrative_Examples, Description, Name, References
CWE Content Team	MITRE	2009-05-27 +00:00	updated Name
CWE Content Team	MITRE	2009-10-29 +00:00	updated Other_Notes, Theoretical_Notes
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Observed_Examples, Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, References, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated References, Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated Affected_Resources, Functional_Areas
CWE Content Team	MITRE	2025-12-11 +00:00	updated Demonstrative_Examples, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description

CWE-72 상세 정보

CWE-72