名称: Improper Handling of Apple HFS+ Alternate Data Stream Path

The product does not properly handle special paths that may identify the data or resource fork of a file on the HFS+ file system.

基本信息

背景详情

引入方式

Implementation

适用平台

编程语言

类： Not Language-Specific (Undetermined)

操作系统

类： macOS (Undetermined)

常见后果

影响范围	影响	可能性
Confidentiality Integrity	Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism 注意： If the product chooses actions to take based on the file name, then if an attacker provides the data or resource fork, the product may take unexpected actions. Further, if the product intends to restrict access to a file, then an attacker might still be able to bypass intended access restrictions by requesting the data or resource fork for that file.

观察示例

参考资料	描述
CVE-2004-1084	Server allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+.

漏洞映射说明

依据 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

备注

This and similar problems exist because the same resource can have multiple identifiers that dictate which behavior can be performed on the resource.
Under-studied

参考资料

REF-578

NetSec Security Advisory: Multiple Vulnerabilities Resulting From Use Of Apple OSX HFS+
NetSec.
https://seclists.org/bugtraq/2005/Feb/309

提交记录

名称	组织	日期	发布日期	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

修改记录

名称	组织	日期	备注
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Relationships, Other_Notes, Taxonomy_Mappings
David Remahl	Apple	2008-11-05 +00:00	clarified description, provided background details, and added demonstrative example
CWE Content Team	MITRE	2008-11-24 +00:00	updated Applicable_Platforms, Background_Details, Demonstrative_Examples, Description, Name, References
CWE Content Team	MITRE	2009-05-27 +00:00	updated Name
CWE Content Team	MITRE	2009-10-29 +00:00	updated Other_Notes, Theoretical_Notes
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Observed_Examples, Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, References, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated References, Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated Affected_Resources, Functional_Areas
CWE Content Team	MITRE	2025-12-11 +00:00	updated Demonstrative_Examples, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description

CWE-72 详情

CWE-72