CWE-703 Detalhe

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Modos de Introdução

Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation

Plataformas Aplicáveis

Linguagem

Class: Not Language-Specific (Undetermined)

Tecnologias

Class: Not Technology-Specific (Undetermined)

Consequências Comuns

Exemplos Observados

Métodos de Detecção

Dynamic Analysis with Manual Results Interpretation

Eficácia : High

Manual Static Analysis - Source Code

Eficácia : High

Automated Static Analysis - Source Code

Eficácia : SOAR Partial

Architecture or Design Review

Eficácia : High

Notas de Mapeamento de Vulnerabilidade

Justificativa : This CWE entry is extremely high-level, a Pillar.
Comentário : Consider children or descendants of this entry instead.

Notas

This is a high-level class that might have some overlap with other classes. It could be argued that even "normal" weaknesses such as buffer overflows involve unusual or exceptional conditions. In that sense, this might be an inherent aspect of most other weaknesses within CWE, similar to API Abuse (CWE-227) and Indicator of Poor Code Quality (CWE-398). However, this entry is currently intended to unify disparate concepts that do not have other places within the Research Concepts view (CWE-1000).

Referências

REF-567

A Taxonomy of Security Faults in the UNIX Operating System
Taimur Aslam.
http://ftp.cerias.purdue.edu/pub/papers/taimur-aslam/aslam-taxonomy-msthesis.pdf

REF-568

Use of A Taxonomy of Security Faults
Taimur Aslam, Ivan Krsul, Eugene H. Spafford.
https://csrc.nist.gov/csrc/media/publications/conference-paper/1996/10/22/proceedings-of-the-19th-nissc-1996/documents/paper057/paper.pdf

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

REF-1374

Randstorm: You Can't Patch a House of Cards
Unciphered.
https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/

REF-1479

State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx

Submissão

Modificações