130
Scope Impact Likelihood
Non-Repudiation
Other
Hide Activities
Other
Potential Mitigations
Phase: Testing
Software tools are capable of finding ADSs on your system.
Phase: Implementation
Ensure that the source code correctly parses the filename to read or write to the correct stream.
Observed Examples
Reference Description
CVE-1999-0278 In IIS, remote attackers can obtain source code for ASP files by appending "::
$DATA" to the URL.
https://www.cve.org/CVERecord?id=CVE-1999-0278
CVE-2000-0927 Product does not properly record file sizes if they are stored in alternative data
streams, which allows users to bypass quota restrictions.
https://www.cve.org/CVERecord?id=CVE-2000-0927
Affected Resources
• System Process
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 904 SFP Primary Cluster: Malware 888 2387
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Notes
Theoretical
This and similar problems exist because the same resource can have multiple identifiers that
dictate which behavior can be performed on the resource.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Windows ::DATA alternate data stream
Related Attack Patterns
CAPEC-ID Attack Pattern Name
168 Windows ::DATA Alternate Data Stream
References
[REF-562]Don Parker. "Windows NTFS Alternate Data Streams". 2005 February 6. < https://
seclists.org/basics/2005/Feb/312 >.2023-04-07.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
CWE-72: Improper Handling of Apple HFS+ Alternate Data Stream Path
CWE Version 4.14
CWE-72: Improper Handling of Apple HFS+ Alternate Data Stream Path
CWE-72: Improper Handling of Apple HFS+ Alternate Data Stream Path