1045
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Missing Handler
Software Fault Patterns SFP4 Unchecked Status Condition
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations
Weakness ID : 432
Structure : Simple
Abstraction : Base
Description
The product uses a signal handler that shares state with other signal handlers, but it does not
properly mask or prevent those signal handlers from being invoked while the original signal handler
is still running.
Extended Description
During the execution of a signal handler, it can be interrupted by another handler when a different
signal is sent. If the two handlers share state - such as global variables - then an attacker can
corrupt the state by sending another signal before the first handler has completed execution.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 364 Signal Handler Race Condition 899
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
Potential Mitigations
Phase: Implementation
Turn off dangerous handlers when performing sensitive operations.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Taxonomy Mappings
CWE Version 4.14
CWE-433: Unparsed Raw Web Content Delivery
CWE-433: Unparsed Raw Web Content Delivery