121
Nature Type ID Name Page
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 980 SFP Secondary Cluster: Link in Resource Name
Resolution
888 2409
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER UNIX hard link
CERT C Secure Coding FIO05-C Identify files using multiple file attributes
Software Fault Patterns SFP18 Link in resource name resolution
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-64: Windows Shortcut Following (.LNK)
Weakness ID : 64
Structure : Simple
Abstraction : Variant
Description
The product, when opening a file or directory, does not sufficiently handle when the file is a
Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow
an attacker to cause the product to operate on unauthorized files.
Extended Description
The shortcut (file with the .lnk extension) can permit an attacker to read/write a file that they
originally did not have permissions to access.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 59 Improper Link Resolution Before File Access ('Link
Following')