928
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Insecure Temporary File
CERT C Secure Coding CON33-
C
Imprecise Avoid race conditions when using
library functions
The CERT Oracle Secure
Coding Standard for Java
(2011)
FIO00-J Do not operate on files in shared
directories
Related Attack Patterns
CAPEC-ID Attack Pattern Name
149 Explore for Predictable Temporary File Names
155 Screen Temporary Files for Sensitive Information
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-378: Creation of Temporary File With Insecure Permissions
Weakness ID : 378
Structure : Simple
Abstraction : Base
Description
Opening temporary files without appropriate measures or controls can leave the file, its contents
and any function that it impacts vulnerable to attack.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 377 Insecure Temporary File 925
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1219 File Handling Issues 2480
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
CWE Version 4.14
CWE-378: Creation of Temporary File With Insecure Permissions
CWE-378: Creation of Temporary File With Insecure Permissions