667
Phase: Architecture and Design
Phase: Operation
The architecture needs to access and modification attributes for files to only those users who
actually require those actions.
Phase: Architecture and Design
Strategy = Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be
unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always
be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate
compartmentalization is built into the system design, and the compartmentalization allows for and
reinforces privilege separation functionality. Architects and designers should rely on the principle
of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Observed Examples
Reference Description
CVE-2005-1941 Executables installed world-writable.
https://www.cve.org/CVERecord?id=CVE-2005-1941
CVE-2002-1713 Home directories installed world-readable.
https://www.cve.org/CVERecord?id=CVE-2002-1713
CVE-2001-1550 World-writable log files allow information loss; world-readable file has cleartext
passwords.
https://www.cve.org/CVERecord?id=CVE-2001-1550
CVE-2002-1711 World-readable directory.
https://www.cve.org/CVERecord?id=CVE-2002-1711
CVE-2002-1844 Windows product uses insecure permissions when installing on Solaris
(genesis: port error).
https://www.cve.org/CVERecord?id=CVE-2002-1844
CVE-2001-0497 Insecure permissions for a shared secret key file. Overlaps cryptographic
problem.
https://www.cve.org/CVERecord?id=CVE-2001-0497
CVE-1999-0426 Default permissions of a device allow IP spoofing.
https://www.cve.org/CVERecord?id=CVE-1999-0426
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 857 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 14 - Input Output (FIO)
844 2368
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 946 SFP Secondary Cluster: Insecure Resource
Permissions
888 2394
MemberOf 1147 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 13. Input Output (FIO)
1133 2450
MemberOf 1198 Privilege Separation and Access Control Issues 1194 2470
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
CWE Version 4.14
CWE-277: Insecure Inherited Permissions
CWE-277: Insecure Inherited Permissions