655
reinforces privilege separation functionality. Architects and designers should rely on the principle
of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Phase: Architecture and Design
Phase: Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage
trust zones in the software.
Phase: Architecture and Design
Strategy = Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met
before permitting access to a system resource.
Demonstrative Examples
Example 1:
The following code calls chroot() to restrict the application to a subset of the filesystem below
APP_HOME in order to prevent an attacker from using the program to gain unauthorized access
to files located elsewhere. The code then opens a file specified by the user and processes the
contents of the file.
Example Language: C (Bad)
chroot(APP_HOME);
chdir("/");
FILE* data = fopen(argv[1], "r+");
...
Constraining the process inside the application's home directory before opening any files is a
valuable security measure. However, the absence of a call to setuid() with some non-zero value
means the application is continuing to operate with unnecessary root privileges. Any successful
exploit carried out by an attacker against the application can now result in a privilege escalation
attack because any malicious operations will be performed with the privileges of the superuser.
If the application drops to the privilege level of a non-root user, the potential for damage is
substantially reduced.
Observed Examples
Reference Description
CVE-2000-1213 Program does not drop privileges after acquiring the raw socket.
https://www.cve.org/CVERecord?id=CVE-2000-1213
CVE-2001-0559 Setuid program does not drop privileges after a parsing error occurs, then calls
another program to handle the error.
https://www.cve.org/CVERecord?id=CVE-2001-0559
CVE-2001-0787 Does not drop privileges in related groups when lowering privileges.
https://www.cve.org/CVERecord?id=CVE-2001-0787
CVE-2002-0080 Does not drop privileges in related groups when lowering privileges.
https://www.cve.org/CVERecord?id=CVE-2002-0080
CVE-2001-1029 Does not drop privileges before determining access to certain files.
https://www.cve.org/CVERecord?id=CVE-2001-1029
CVE-1999-0813 Finger daemon does not drop privileges when executing programs on behalf of
the user being fingered.
https://www.cve.org/CVERecord?id=CVE-1999-0813
CVE-1999-1326 FTP server does not drop privileges if a connection is aborted during file
transfer.
https://www.cve.org/CVERecord?id=CVE-1999-1326
CVE-2000-0172 Program only uses seteuid to drop privileges.
CWE Version 4.14
CWE-272: Least Privilege Violation
CWE-272: Least Privilege Violation