1022
References
[REF-354]Blake Watts. "Discovering and Exploiting Named Pipe Security Flaws for Fun and Profit".
2002 April. < https://www.blakewatts.com/blog/discovering-and-exploiting-named-pipe-securityflaws-
for-fun-and-profit >.2023-04-07.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-422: Unprotected Windows Messaging Channel ('Shatter')
Weakness ID : 422
Structure : Simple
Abstraction : Variant
Description
The product does not properly verify the source of a message in the Windows Messaging System
while running at elevated privileges, creating an alternate channel through which an attacker can
directly send a message to the product.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 360 Trust of System Event Data 887
ChildOf 420 Unprotected Alternate Channel 1018
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Bypass Protection Mechanism
Potential Mitigations
Phase: Architecture and Design
Always verify and authenticate the source of the message.
Observed Examples
Reference Description
CVE-2002-0971 Bypass GUI and access restricted dialog box.
https://www.cve.org/CVERecord?id=CVE-2002-0971
CVE-2002-1230 Gain privileges via Windows message.
https://www.cve.org/CVERecord?id=CVE-2002-1230
CVE-2003-0350 A control allows a change to a pointer for a callback function using Windows
message.
https://www.cve.org/CVERecord?id=CVE-2003-0350
CVE-2003-0908 Product launches Help functionality while running with raised privileges,
allowing command execution using Windows message to access "open file"
dialog.
CWE Version 4.14
CWE-424: Improper Protection of Alternate Path
CWE-424: Improper Protection of Alternate Path