1101
Functional Areas
• File Processing
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 857 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 14 - Input Output (FIO)
844 2368
MemberOf 982 SFP Secondary Cluster: Failure to Release Resource 888 2410
MemberOf 1141 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 07. Exceptional Behavior (ERR)
1133 2448
MemberOf 1147 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 13. Input Output (FIO)
1133 2450
MemberOf 1162 SEI CERT C Coding Standard - Guidelines 08. Memory
Management (MEM)
1154 2458
MemberOf 1163 SEI CERT C Coding Standard - Guidelines 09. Input
Output (FIO)
1154 2459
MemberOf 1306 CISQ Quality Measures - Reliability 1305 2483
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Relationship
CWE-459 is a child of CWE-404 because, while CWE-404 covers any type of improper shutdown
or release of a resource, CWE-459 deals specifically with a multi-step shutdown process in which
a crucial step for "proper" cleanup is omitted or impossible. That is, CWE-459 deals specifically
with a cleanup or shutdown process that does not successfully remove all potentially sensitive
data.
Relationship
Overlaps other categories such as permissions and containment. Concept needs further
development. This could be primary (e.g. leading to infoleak) or resultant (e.g. resulting from
unhandled error conditions or early termination).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Incomplete Cleanup
OWASP Top Ten 2004 A10 CWE More Specific Insecure Configuration Management
CERT C Secure Coding FIO42-C CWE More
Abstract
Close files when they are no longer
needed
CERT C Secure Coding MEM31-
C
CWE More
Abstract
Free dynamically allocated memory
when no longer needed
The CERT Oracle Secure
Coding Standard for Java
(2011)
FIO04-J Release resources when they are no
longer needed
The CERT Oracle Secure
Coding Standard for Java
(2011)
FIO00-J Do not operate on files in shared
directories
Software Fault Patterns SFP14 Failure to release resource
CWE Version 4.14
CWE-460: Improper Cleanup on Thrown Exception
CWE-460: Improper Cleanup on Thrown Exception