1561
Notes
Maintenance
The relationships between privileges, permissions, and actors (e.g. users and groups) need
further refinement within the Research view. One complication is that these concepts apply to
two different pillars, related to control of resources (CWE-664) and protection mechanism failures
(CWE-693).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
FIO03-J Create files with appropriate access
permission
The CERT Oracle Secure
Coding Standard for Java
(2011)
SEC01-J Do not allow tainted variables in
privileged blocks
The CERT Oracle Secure
Coding Standard for Java
(2011)
ENV03-J Do not grant dangerous combinations
of permissions
CERT C Secure Coding FIO06-C Create files with appropriate access
permissions
Related Attack Patterns
CAPEC-ID Attack Pattern Name
1 Accessing Functionality Not Properly Constrained by ACLs
17 Using Malicious Files
60 Reusing Session IDs (aka Session Replay)
61 Session Fixation
62 Cross Site Request Forgery
122 Privilege Abuse
127 Directory Indexing
180 Exploiting Incorrectly Configured Access Control Security Levels
206 Signing Malicious Code
234 Hijacking a privileged process
642 Replace Binaries
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-207]John Viega and Gary McGraw. "Building Secure Software: How to Avoid Security
Problems the Right Way". 1st Edition. 2002. Addison-Wesley.
[REF-594]Jason Lam. "Top 25 Series - Rank 21 - Incorrect Permission Assignment for Critical
Response". 2010 March 4. SANS Software Security Institute. < http://software-security.sans.org/
blog/2010/03/24/top-25-series-rank-21-incorrect-permission-assignment-for-critical-response >.
[REF-199]NIST. "United States Government Configuration Baseline (USGCB)". < https://
csrc.nist.gov/Projects/United-States-Government-Configuration-Baseline >.2023-03-28.
[REF-1287]MITRE. "Supplemental Details - 2022 CWE Top 25". 2022 June 8. < https://
cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails
>.
[REF-1307]Center for Internet Security. "CIS Microsoft Azure Foundations Benchmark version
1.5.0". 2022 August 6. < https://www.cisecurity.org/benchmark/azure >.2023-01-19.
CWE Version 4.14
CWE-733: Compiler Optimization Removal or Modification of Security-critical Code
CWE-733: Compiler Optimization Removal
or Modification of Security-critical Code 1562
[REF-1327]Center for Internet Security. "CIS Google Cloud Computing Platform
Benchmark version 1.3.0". 2022 March 1. < https://www.cisecurity.org/benchmark/
google_cloud_computing_platform >.2023-04-24.
CWE-733: Compiler Optimization Removal or Modification of Security-critical
Code
Weakness ID : 733
Structure : Simple
Abstraction : Base
Description
The developer builds a security-critical protection mechanism into the software, but the compiler
optimizes the program such that the mechanism is removed or modified.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1038 Insecure Automated Optimizations 1872
ParentOf 14 Compiler Removal of Code to Clear Buffers 14
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 438 Behavioral Problems 2326
Applicable Platforms
Language : C (Prevalence = Often)
Language : C++ (Prevalence = Often)
Language : Compiled (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control
Other
Bypass Protection Mechanism
Other
Detection Methods
Black Box
This specific weakness is impossible to detect using black box methods. While an analyst could
examine memory to see that it has not been scrubbed, an analysis of the executable would
not be successful. This is because the compiler has already removed the relevant code. Only
the source code shows whether the programmer intended to clear the memory or not, so this
weakness is indistinguishable from others.
White Box
This weakness is only detectable using white box methods (see black box detection factor).
Careful analysis is required to determine if the code is likely to be removed by the compiler.
Demonstrative Examples
CWE Version 4.14
CWE-733: Compiler Optimization Removal or Modification of Security-critical Code
CWE-733: Compiler Optimization Removal
or Modification of Security-critical Code