Szczegóły CWE-463

The accidental deletion of a data-structure sentinel can cause serious programming logic problems.

Often times data-structure sentinels are used to mark structure of the data structure. A common example of this is the null character at the end of strings. Another common example is linked lists which may contain a sentinel to mark the end of the list. It is dangerous to allow this type of control data to be easily accessible. Therefore, it is important to protect from the deletion or modification outside of some wrapper interface which provides safety.

Sposoby wprowadzenia

Implementation

Odpowiednie platformy

Język

Name: C (Undetermined)
Name: C++ (Undetermined)

Typowe konsekwencje

Potencjalne środki zaradcze

Phases : Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Phases : Build and Compilation
Phases : Operation
Use OS-level preventative functionality. Not a complete solution.

Uwagi dotyczące mapowania podatności

Uzasadnienie : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentarz : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Odniesienia

REF-18

The CLASP Application Security Process
Secure Software, Inc..
https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

Zgłoszenie

Modyfikacje