659
System.loadLibrary("awt");
return null;
// nothing to return
}
Example 3:
The following code calls chroot() to restrict the application to a subset of the filesystem below
APP_HOME in order to prevent an attacker from using the program to gain unauthorized access
to files located elsewhere. The code then opens a file specified by the user and processes the
contents of the file.
Example Language: C (Bad)
chroot(APP_HOME);
chdir("/");
FILE* data = fopen(argv[1], "r+");
...
Constraining the process inside the application's home directory before opening any files is a
valuable security measure. However, the absence of a call to setuid() with some non-zero value
means the application is continuing to operate with unnecessary root privileges. Any successful
exploit carried out by an attacker against the application can now result in a privilege escalation
attack because any malicious operations will be performed with the privileges of the superuser.
If the application drops to the privilege level of a non-root user, the potential for damage is
substantially reduced.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 254 7PK - Security Features 700 2314
MemberOf 748 CERT C Secure Coding Standard (2008) Appendix -
POSIX (POS)
734 2351
MemberOf 859 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 16 - Platform Security (SEC)
844 2369
MemberOf 901 SFP Primary Cluster: Privilege 888 2386
MemberOf 1149 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 15. Platform Security (SEC)
1133 2452
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
CWE-271, CWE-272, and CWE-250 are all closely related and possibly overlapping. CWE-271 is
probably better suited as a category.
Other
If system privileges are not dropped when it is reasonable to do so, this is not a vulnerability
by itself. According to the principle of least privilege, access should be allowed only when it
is absolutely necessary to the function of a given system, and only for the minimal necessary
amount of time. Any further allowance of privilege widens the window of time during which a
successful exploitation of the system will provide an attacker with that same privilege. If at all
possible, limit the allowance of system privilege to small, simple sections of code that may be
called atomically. When a program calls a privileged function, such as chroot(), it must first
CWE Version 4.14
CWE-273: Improper Check for Dropped Privileges
CWE-273: Improper Check for Dropped Privileges