名稱: Path Equivalence: Windows 8.3 Filename

The product contains a protection mechanism that restricts access to a long filename on a Windows operating system, but it does not properly restrict access to the equivalent short "8.3" filename.

一般資訊

背景詳情

引入方式

Implementation

適用平台

程式語言

類別： Not Language-Specific (Undetermined)

作業系統

類別： Windows (Undetermined)

技術

類別： Not Technology-Specific (Undetermined)

常見後果

範圍	影響	可能性
Confidentiality Integrity	Read Files or Directories, Modify Files or Directories

觀察到的案例

參考資料	描述
CVE-1999-0012	Multiple web servers allow restriction bypass using 8.3 names instead of long names
CVE-2001-0795	Server allows remote attackers to obtain source code of CGI scripts via URLs that contain MS-DOS conventions such as (1) upper case letters (CWE-178) or (2) 8.3 file names (CWE-58).
CVE-2005-0471	Multi-Factor Vulnerability. Product generates temporary filenames using long filenames, which become predictable in 8.3 format.

潛在緩解措施

Phases : System Configuration
Disable Windows from supporting 8.3 filenames by editing the Windows registry. Preventing 8.3 filenames will not remove previously generated 8.3 filenames.

漏洞對應備注

理由說明 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

備注

Probably under-studied.

參考資料

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

提交

名稱	機構	日期	發布日期	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

修改記錄

名稱	機構	日期	備註
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Applicable_Platforms, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2008-10-14 +00:00	updated Description
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated References, Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, References
CWE Content Team	MITRE	2018-03-27 +00:00	updated References
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated Affected_Resources
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Background_Details, Description, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Observed_Examples

CWE-58 詳細資料

CWE-58