Chi tiết CWE-463

The accidental deletion of a data-structure sentinel can cause serious programming logic problems.

Often times data-structure sentinels are used to mark structure of the data structure. A common example of this is the null character at the end of strings. Another common example is linked lists which may contain a sentinel to mark the end of the list. It is dangerous to allow this type of control data to be easily accessible. Therefore, it is important to protect from the deletion or modification outside of some wrapper interface which provides safety.

Các cách xuất hiện

Implementation

Nền tảng áp dụng

Ngôn ngữ

Tên: C (Undetermined)
Tên: C++ (Undetermined)

Hậu quả phổ biến

Các biện pháp giảm thiểu tiềm năng

Phases : Architecture and Design
Use an abstraction library to abstract away risky APIs. Not a complete solution.
Phases : Build and Compilation
Phases : Operation
Use OS-level preventative functionality. Not a complete solution.

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Ghi chú

Tài liệu tham khảo

REF-18

The CLASP Application Security Process
Secure Software, Inc..
https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

Gửi

Sửa đổi