662
Phase: Architecture and Design
Strategy = Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be
unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always
be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate
compartmentalization is built into the system design, and the compartmentalization allows for and
reinforces privilege separation functionality. Architects and designers should rely on the principle
of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Phase: Implementation
Check the results of all functions that return a value and verify that the value is expected.
Effectiveness = High
Checking the return value of the function will typically be sufficient, however beware of race
conditions (CWE-362) in a concurrent environment.
Phase: Implementation
In Windows, make sure that the process token has the SeImpersonatePrivilege(Microsoft
Server 2003). Code that relies on impersonation for security must ensure that the impersonation
succeeded, i.e., that a proper privilege demotion happened.
Demonstrative Examples
Example 1:
This code attempts to take on the privileges of a user before creating a file, thus avoiding
performing the action with unnecessarily high privileges:
Example Language: C++ (Bad)
bool DoSecureStuff(HANDLE hPipe) {
bool fDataWritten = false;
ImpersonateNamedPipeClient(hPipe);
HANDLE hFile = CreateFile(...);
/../
RevertToSelf()
/../
}
The call to ImpersonateNamedPipeClient may fail, but the return value is not checked. If the call
fails, the code may execute with higher privileges than intended. In this case, an attacker could
exploit this behavior to write a file to a location that the attacker does not have access to.
Observed Examples
Reference Description
CVE-2006-4447 Program does not check return value when invoking functions to drop
privileges, which could leave users with higher privileges than expected by
forcing those functions to fail.
https://www.cve.org/CVERecord?id=CVE-2006-4447
CVE-2006-2916 Program does not check return value when invoking functions to drop
privileges, which could leave users with higher privileges than expected by
forcing those functions to fail.
https://www.cve.org/CVERecord?id=CVE-2006-2916
Affected Resources
• System Process
MemberOf Relationships
CWE Version 4.14
CWE-274: Improper Handling of Insufficient Privileges
CWE-274: Improper Handling of Insufficient Privileges