110
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER dirname/fakechild/../realchild/filename
Software Fault Patterns SFP16 Path Traversal
CWE-58: Path Equivalence: Windows 8.3 Filename
Weakness ID : 58
Structure : Simple
Abstraction : Variant
Description
The product contains a protection mechanism that restricts access to a long filename on a
Windows operating system, but it does not properly restrict access to the equivalent short "8.3"
filename.
Extended Description
On later Windows operating systems, a file can have a "long name" and a short name that
is compatible with older Windows file systems, with up to 8 characters in the filename and 3
characters for the extension. These "8.3" filenames, therefore, act as an alternate name for files
with long names, so they are useful pathname equivalence manipulations.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 41 Improper Resolution of Path Equivalence 86
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Windows (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Files or Directories
Modify Files or Directories
Potential Mitigations
Phase: System Configuration
Disable Windows from supporting 8.3 filenames by editing the Windows registry. Preventing 8.3
filenames will not remove previously generated 8.3 filenames.
Observed Examples
Reference Description
CVE-1999-0012 Multiple web servers allow restriction bypass using 8.3 names instead of long
names
https://www.cve.org/CVERecord?id=CVE-1999-0012
CVE-2001-0795 Source code disclosure using 8.3 file name.
https://www.cve.org/CVERecord?id=CVE-2001-0795
CWE Version 4.14
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-59: Improper Link Resolution Before File Access ('Link Following')