1462
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
DCL00-J Prevent class initialization cycles
Software Fault Patterns SFP4 Unchecked Status Condition
Related Attack Patterns
CAPEC-ID Attack Pattern Name
26 Leveraging Race Conditions
29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
References
[REF-436]mercy. "Exploiting Uninitialized Data". 2006 January. < http://www.felinemenace.org/
~mercy/papers/UBehavior/UBehavior.zip >.
[REF-437]Microsoft Security Vulnerability Research & Defense. "MS08-014 : The Case of
the Uninitialized Stack Variable Vulnerability". 2008 March 1. < https://msrc.microsoft.com/
blog/2008/03/ms08-014-the-case-of-the-uninitialized-stack-variable-vulnerability/ >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-666: Operation on Resource in Wrong Phase of Lifetime
Weakness ID : 666
Structure : Simple
Abstraction : Class
Description
The product performs an operation on a resource at the wrong phase of the resource's lifecycle,
which can lead to unexpected behaviors.
Extended Description
A resource's lifecycle includes several phases: initialization, use, and release. For each phase, it is
important to follow the specifications outlined for how to operate on the resource and to ensure that
the resource is in the expected phase. Otherwise, if a resource is in one phase but the operation
is not valid for that phase (i.e., an incorrect phase of the resource's lifetime), then this can produce
resultant weaknesses. For example, using a resource before it has been fully initialized could
cause corruption or incorrect data to be used.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 664 Improper Control of a Resource Through its Lifetime 1454
ParentOf 415 Double Free 1008
ParentOf 593 Authentication Bypass: OpenSSL CTX Object Modified after
SSL Objects are Created