名稱: Improper Handling of Apple HFS+ Alternate Data Stream Path

The product does not properly handle special paths that may identify the data or resource fork of a file on the HFS+ file system.

一般資訊

背景詳情

引入方式

Implementation

適用平台

程式語言

類別： Not Language-Specific (Undetermined)

作業系統

類別： macOS (Undetermined)

常見後果

範圍	影響	可能性
Confidentiality Integrity	Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism 注意：If the product chooses actions to take based on the file name, then if an attacker provides the data or resource fork, the product may take unexpected actions. Further, if the product intends to restrict access to a file, then an attacker might still be able to bypass intended access restrictions by requesting the data or resource fork for that file.

觀察到的案例

參考資料	描述
CVE-2004-1084	Server allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+.

漏洞對應備注

理由說明 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

備注

This and similar problems exist because the same resource can have multiple identifiers that dictate which behavior can be performed on the resource.
Under-studied

參考資料

REF-578

NetSec Security Advisory: Multiple Vulnerabilities Resulting From Use Of Apple OSX HFS+
NetSec.
https://seclists.org/bugtraq/2005/Feb/309

提交

名稱	機構	日期	發布日期	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

修改記錄

名稱	機構	日期	備註
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Relationships, Other_Notes, Taxonomy_Mappings
David Remahl	Apple	2008-11-05 +00:00	clarified description, provided background details, and added demonstrative example
CWE Content Team	MITRE	2008-11-24 +00:00	updated Applicable_Platforms, Background_Details, Demonstrative_Examples, Description, Name, References
CWE Content Team	MITRE	2009-05-27 +00:00	updated Name
CWE Content Team	MITRE	2009-10-29 +00:00	updated Other_Notes, Theoretical_Notes
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Observed_Examples, Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, References, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated References, Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated Affected_Resources, Functional_Areas
CWE Content Team	MITRE	2025-12-11 +00:00	updated Demonstrative_Examples, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description

CWE-72 詳細資料

CWE-72