名稱: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
一般資訊
引入方式
Implementation適用平台
程式語言
類別： Not Language-Specific (Undetermined)名稱： Python (Undetermined)
常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Other Confidentiality Integrity | Other, Read Application Data, Modify Application Data, DoS: Resource Consumption (Other) 注意：It is possible to overflow the number of temporary files because directories typically have limits on the number of files allowed. This could create a denial of service problem. |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2000-0552 | World-readable temporary file not deleted after use. |
CVE-2005-2293 | Temporary file not deleted after use, leaking database usernames and passwords. |
CVE-2002-0788 | Interaction error creates a temporary file that can not be deleted due to strong permissions. |
CVE-2002-2066 | Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak). |
CVE-2002-2067 | Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak). |
CVE-2002-2068 | Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak). |
CVE-2002-2069 | Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak). |
CVE-2002-2070 | Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak). |
CVE-2005-1744 | Users not logged out when application is restarted after security-relevant changes were made. |
潛在緩解措施
Phases : Architecture and Design // ImplementationTemporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
偵測方法
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)有效性 : High
漏洞對應備注
理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
備注
CWE-459 is a child of CWE-404 because, while CWE-404 covers any type of improper shutdown or release of a resource, CWE-459 deals specifically with a multi-step shutdown process in which a crucial step for "proper" cleanup is omitted or impossible. That is, CWE-459 deals specifically with a cleanup or shutdown process that does not successfully remove all potentially sensitive data.Overlaps other categories such as permissions and containment. Concept needs further development. This could be primary (e.g. leading to infoleak) or resultant (e.g. resulting from unhandled error conditions or early termination).
參考資料
REF-1534
Automated Technical Debt Measure, Version 2OMG.
https://www.omg.org/spec/ATDM2/1.0/PDF
REF-1541
Secure Coding Guide for PythonOpenSSF.
https://best.openssf.org/Secure-Coding-Guide-for-Python/
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Sean Eidemiller | Cigital | added/updated demonstrative examples | |
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationship_Notes, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences, Other_Notes, Relationship_Notes | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Detection_Factors, Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Applicable_Platforms, References, Relationships, Taxonomy_Mappings |
