123
Nature Type ID Name Page
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Notes
Research Gap
Under-studied. Windows .LNK files are more "portable" than Unix symlinks and have been used
in remote exploits. Some Windows API's will access LNK's as if they are regular files, so one
would expect that they would be reported more frequently.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Windows Shortcut Following (.LNK)
CERT C Secure Coding FIO05-C Identify files using multiple file attributes
Software Fault Patterns SFP18 Link in resource name resolution
CWE-65: Windows Hard Link
Weakness ID : 65
Structure : Simple
Abstraction : Variant
Description
The product, when opening a file or directory, does not sufficiently handle when the name is
associated with a hard link to a target that is outside of the intended control sphere. This could
allow an attacker to cause the product to operate on unauthorized files.
Extended Description
Failure for a system to check for hard links can result in vulnerability to different types of attacks.
For example, an attacker can escalate their privileges if a file used by a privileged program is
replaced with a hard link to a sensitive file (e.g. AUTOEXEC.BAT). When the process opens the
file, the attacker can assume the privileges of that process, or prevent the program from accurately
processing data.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 59 Improper Link Resolution Before File Access ('Link
Following')