599
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-250: Execution with Unnecessary Privileges
Weakness ID : 250
Structure : Simple
Abstraction : Base
Description
The product performs an operation at a privilege level that is higher than the minimum level
required, which creates new weaknesses or amplifies the consequences of other weaknesses.
Extended Description
New weaknesses can be exposed because running with extra privileges, such as root or
Administrator, can disable the normal security checks being performed by the operating system
or surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if
they occur while operating at raised privileges.
Privilege management functions can behave in some less-than-obvious ways, and they have
different quirks on different platforms. These inconsistencies are particularly pronounced if you are
transitioning from one non-root user to another. Signal handlers and spawned processes run at
the privilege of the owning process, so if a process is running as root when a signal fires or a subprocess
is executed, the signal handler or sub-process will operate with root privileges.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 657 Violation of Secure Design Principles 1446
ChildOf 269 Improper Privilege Management 646
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1015 Limit Access 2430
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 265 Privilege Issues 2316
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Mobile (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
CWE Version 4.14
CWE-250: Execution with Unnecessary Privileges
CWE-250: Execution with Unnecessary Privileges