1273
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 663 Use of a Non-reentrant Function in a Concurrent Context 1452
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Access Control
Other
Modify Application Data
Bypass Protection Mechanism
Other
Potential Mitigations
Phase: Architecture and Design
Using names for security purposes is not advised. Names are easy to forge and can have
overlapping user IDs, potentially causing confusion or impersonation.
Phase: Implementation
Use getlogin_r() instead, which is reentrant, meaning that other processes are locked out from
changing the username.
Demonstrative Examples
Example 1:
The following code relies on getlogin() to determine whether or not a user is trusted. It is easily
subverted.
Example Language: C (Bad)
pwd = getpwnam(getlogin());
if (isTrustedGroup(pwd->pw_gid)) {
allow();
} else {
deny();
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 227 7PK - API Abuse 700 2313
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Taxonomy Mappings
CWE Version 4.14
CWE-560: Use of umask() with chmod-style Argument
CWE-560: Use of umask() with chmod-style Argument