1514
Reference Description
CVE-2005-2174 Product inserts a new object into database before setting the object's
permissions, introducing a race condition.
https://www.cve.org/CVERecord?id=CVE-2005-2174
CVE-2006-5214 Error file has weak permissions before a chmod is performed.
https://www.cve.org/CVERecord?id=CVE-2006-5214
CVE-2005-2475 Archive permissions issue using hard link.
https://www.cve.org/CVERecord?id=CVE-2005-2475
CVE-2003-0265 Database product creates files world-writable before initializing the setuid bits,
leading to modification of executables.
https://www.cve.org/CVERecord?id=CVE-2003-0265
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Notes
Research Gap
Under-studied. It seems likely that this weakness could occur in any situation in which a complex
or large copy operation occurs, when the resource can be made available to other spheres as
soon as it is created, but before its initialization is complete.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
26 Leveraging Race Conditions
27 Leveraging Race Conditions via Symbolic Links
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-690: Unchecked Return Value to NULL Pointer Dereference
Weakness ID : 690
Structure : Chain
Abstraction : Compound
Description
The product does not check for an error after calling a function that can return with a NULL pointer
if the function fails, which leads to a resultant NULL pointer dereference.
Chain Components
Nature Type ID Name Page
StartsWith 252 Unchecked Return Value 606
FollowedBy 476 NULL Pointer Dereference 1132
Extended Description
While unchecked return value weaknesses are not limited to returns of NULL pointers (see the
examples in CWE-252), functions often return NULL to indicate an error status. When this error
condition is not checked, a NULL pointer dereference can occur.
CWE Version 4.14
CWE-690: Unchecked Return Value to NULL Pointer Dereference
CWE-690: Unchecked Return Value to NULL Pointer Dereference