600
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Access Control
Gain Privileges or Assume Identity
Execute Unauthorized Code or Commands
Read Application Data
DoS: Crash, Exit, or Restart
An attacker will be able to gain access to any resources
that are allowed by the extra privileges. Common results
include executing code, disabling services, and reading
restricted data.
Detection Methods
Manual Analysis
This weakness can be detected using tools and techniques that require manual (human)
analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester
to record and modify an active session.
Black Box
Use monitoring tools that examine the software's process as it interacts with the operating
system and the network. This technique is useful in cases when source code is unavailable, if the
software was not developed by you, or if you want to verify that the build phase did not introduce
any new weaknesses. Examples include debuggers that directly attach to the running process;
system-call tracing utilities such as truss (Solaris) and strace (Linux); system activity monitors
such as FileMon, RegMon, Process Monitor, and other Sysinternals utilities (Windows); and
sniffers and protocol analyzers that monitor network traffic. Attach the monitor to the process
and perform a login. Look for library functions and system calls that indicate when privileges are
being raised or dropped. Look for accesses of resources that are restricted to normal users.
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Compare binary / bytecode to application permission manifest Cost effective for partial coverage:
Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary
Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness = High
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Host-based Vulnerability Scanners - Examine configuration for flaws, verifying that
audit mechanisms work, ensure host configuration meets certain predefined criteria
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Host Application Interface Scanner
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
CWE Version 4.14
CWE-250: Execution with Unnecessary Privileges
CWE-250: Execution with Unnecessary Privileges