953
Reference Description
[REF-1374] Chain: JavaScript-based cryptocurrency library can fall back to the insecure
Math.random() function instead of reporting a failure (CWE-392), thus reducing
the entropy (CWE-332) and leading to generation of non-unique cryptographic
keys for Bitcoin wallets (CWE-1391)
https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards
CVE-2004-0063 Function returns "OK" even if another function returns a different status code
than expected, leading to accepting an invalid PIN number.
https://www.cve.org/CVERecord?id=CVE-2004-0063
CVE-2002-1446 Error checking routine in PKCS#11 library returns "OK" status even when
invalid signature is detected, allowing spoofed messages.
https://www.cve.org/CVERecord?id=CVE-2002-1446
CVE-2002-0499 Kernel function truncates long pathnames without generating an error, leading
to operation on wrong directory.
https://www.cve.org/CVERecord?id=CVE-2002-0499
CVE-2005-2459 Function returns non-error value when a particular erroneous condition is
encountered, leading to resultant NULL dereference.
https://www.cve.org/CVERecord?id=CVE-2005-2459
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 855 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 12 - Thread Pools (TPS)
844 2367
MemberOf 884 CWE Cross-section 884 2567
MemberOf 961 SFP Secondary Cluster: Incorrect Exception Behavior 888 2399
MemberOf 1145 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 11. Thread Pools (TPS)
1133 2450
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Missing Error Status Code
The CERT Oracle Secure
Coding Standard for Java
(2011)
TPS03-J Ensure that tasks executing in a thread
pool do not fail silently
Software Fault Patterns SFP6 Incorrect Exception Behavior
References
[REF-1374]Unciphered. "Randstorm: You Can't Patch a House of Cards". 2023 November 4. <
https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards >.2023-11-15.
CWE-393: Return of Wrong Status Code
Weakness ID : 393
Structure : Simple
Abstraction : Base
Description
A function or operation returns an incorrect return value or status code that does not indicate an
error, but causes the product to modify its behavior based on the incorrect result.
CWE Version 4.14
CWE-393: Return of Wrong Status Code
CWE-393: Return of Wrong Status Code