CWE-395
Use of NullPointerException Catch to Detect NULL Pointer Dereference
2006-07-19
00h00 +00:00
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: Use of NullPointerException Catch to Detect NULL Pointer Dereference
Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.
一般資訊
引入方式
Implementation適用平台
程式語言
名稱： Java (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Availability | DoS: Resource Consumption (CPU) | |
| Other | Quality Degradation |
潛在緩解措施
Phases : Architecture and Design // ImplementationDo not extensively rely on catching exceptions (especially for validating user input) to handle errors. Handling exceptions can decrease the performance of an application.
偵測方法
Automated Static Analysis - Binary or Bytecode
有效性 : SOAR PartialDynamic Analysis with Manual Results Interpretation
有效性 : SOAR PartialManual Static Analysis - Source Code
有效性 : SOAR PartialAutomated Static Analysis - Source Code
有效性 : HighArchitecture or Design Review
有效性 : High漏洞對應備注
理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
參考資料
REF-6
Seven Pernicious Kingdoms: A Taxonomy of Software Security ErrorsKatrina Tsipenyuk, Brian Chess, Gary McGraw.
https://cwe.mitre.org/documents/sources/SevenPerniciousKingdoms.pdf
REF-1479
State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and EvaluationGregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| 7 Pernicious Kingdoms | Draft 3 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Other_Notes, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Description, Other_Notes | |
| CWE Content Team | MITRE | updated Detection_Factors, Relationships | |
| CWE Content Team | MITRE | updated Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated References | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Detection_Factors, References | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Modes_of_Introduction, References, Type |
