1549
Phase: Testing
Use automated tools to check for privilege settings.
Observed Examples
Reference Description
CVE-2007-5101 File system sets wrong ownership and group when creating a new file.
https://www.cve.org/CVERecord?id=CVE-2007-5101
CVE-2007-4238 OS installs program with bin owner/group, allowing modification.
https://www.cve.org/CVERecord?id=CVE-2007-4238
CVE-2007-1716 Manager does not properly restore ownership of a reusable resource when a
user logs out, allowing privilege escalation.
https://www.cve.org/CVERecord?id=CVE-2007-1716
CVE-2005-3148 Backup software restores symbolic links with incorrect uid/gid.
https://www.cve.org/CVERecord?id=CVE-2005-3148
CVE-2005-1064 Product changes the ownership of files that a symlink points to, instead of the
symlink itself.
https://www.cve.org/CVERecord?id=CVE-2005-1064
CVE-2011-1551 Component assigns ownership of sensitive directory tree to a user account,
which can be leveraged to perform privileged operations.
https://www.cve.org/CVERecord?id=CVE-2011-1551
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 884 CWE Cross-section 884 2567
MemberOf 944 SFP Secondary Cluster: Access Management 888 2393
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
This overlaps verification errors, permissions, and privileges. A closely related weakness is the
incorrect assignment of groups to a resource. It is not clear whether it would fall under this entry
or require a different entry.
CWE-710: Improper Adherence to Coding Standards
Weakness ID : 710
Structure : Simple
Abstraction : Pillar
Description
The product does not follow certain coding rules for development, which can lead to resultant
weaknesses or increase the severity of the associated vulnerabilities.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
CWE Version 4.14
CWE-710: Improper Adherence to Coding Standards
CWE-710: Improper Adherence to Coding Standards