126
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review
(not inspections)
Effectiveness = High
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Source code Weakness Analyzer Context-configured Source Code Weakness
Analyzer
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE
1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness = High
Observed Examples
Reference Description
CVE-1999-0278 In IIS, remote attackers can obtain source code for ASP files by appending "::
$DATA" to the URL.
https://www.cve.org/CVERecord?id=CVE-1999-0278
CVE-2004-1084 Server allows remote attackers to read files and resource fork content via
HTTP requests to certain special file names related to multiple data streams in
HFS+.
https://www.cve.org/CVERecord?id=CVE-2004-1084
CVE-2002-0106 Server allows remote attackers to cause a denial of service via a series of
requests to .JSP files that contain an MS-DOS device name.
https://www.cve.org/CVERecord?id=CVE-2002-0106
Functional Areas
• File Processing
Affected Resources
• File or Directory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 981 SFP Secondary Cluster: Path Traversal 888 2409
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Virtual Files
CWE-67: Improper Handling of Windows Device Names
Weakness ID : 67
Structure : Simple
Abstraction : Variant
CWE Version 4.14
CWE-67: Improper Handling of Windows Device Names
CWE-67: Improper Handling of Windows Device Names