Tên: Improper Handling of Windows Device Names

The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.

Thông tin chung

Chi tiết nền tảng

Các cách xuất hiện

Implementation
Operation

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)

Hệ điều hành

Lớp: Windows (Undetermined)

Hậu quả phổ biến

Phạm vi	Tác động	Khả năng xảy ra
Availability Confidentiality Other	DoS: Crash, Exit, or Restart, Read Application Data, Other Ghi chú: Not properly handling virtual filenames (e.g. AUX, CON, PRN, COM1, LPT1) can result in different types of vulnerabilities. In some cases an attacker can request a device via injection of a virtual filename in a URL, which may cause an error that leads to a denial of service or an error page that reveals sensitive information. A product that allows device names to bypass filtering runs the risk of an attacker injecting malicious code in a file with the name of a device.

Ví dụ đã quan sát

Tài liệu tham khảo	Mô tả
CVE-2002-0106	Server allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name.
CVE-2002-0200	Server allows remote attackers to cause a denial of service via an HTTP request for an MS-DOS device name.
CVE-2002-1052	Product allows remote attackers to use MS-DOS device names in HTTP requests to cause a denial of service or obtain the physical path of the server.
CVE-2001-0493	Server allows remote attackers to cause a denial of service via a URL that contains an MS-DOS device name.
CVE-2001-0558	Server allows a remote attacker to create a denial of service via a URL request which includes a MS-DOS device name.
CVE-2000-0168	Microsoft Windows 9x operating systems allow an attacker to cause a denial of service via a pathname that includes file device names, aka the "DOS Device in Path Name" vulnerability.
CVE-2001-0492	Server allows remote attackers to determine the physical path of the server via a URL containing MS-DOS device names.
CVE-2004-0552	Product does not properly handle files whose names contain reserved MS-DOS device names, which can allow malicious code to bypass detection when it is installed, copied, or executed.
CVE-2005-2195	Server allows remote attackers to cause a denial of service (application crash) via a URL with a filename containing a .cgi extension and an MS-DOS device name.

Các biện pháp giảm thiểu tiềm năng

Phases : Implementation
Be familiar with the device names in the operating system where your system is deployed. Check input for these device names.

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Tài liệu tham khảo

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Applicable_Platforms, Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities
CWE Content Team	MITRE	2008-10-14 +00:00	updated Description
CWE Content Team	MITRE	2008-11-24 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2009-03-10 +00:00	updated Description, Name
CWE Content Team	MITRE	2009-10-29 +00:00	updated Background_Details, Other_Notes
CWE Content Team	MITRE	2010-09-27 +00:00	updated Description
CWE Content Team	MITRE	2011-03-29 +00:00	updated Description
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2011-09-13 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2012-05-11 +00:00	updated Observed_Examples, References, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2017-11-08 +00:00	updated Affected_Resources, Applicable_Platforms, Causal_Nature, Likelihood_of_Exploit, References, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2018-03-27 +00:00	updated References
CWE Content Team	MITRE	2019-01-03 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated Functional_Areas
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description

Chi tiết CWE-67

CWE-67