1570
Scope Impact Likelihood
Availability Unexpected State
The data which were produced as a result of a function call
could be in a bad state upon return. If the return value is
not checked, then this bad data may be used in operations,
possibly leading to a crash or other unintended behaviors.
Detection Methods
Automated Static Analysis
Automated static analysis may be useful for detecting unusual conditions involving system
resources or common programming idioms, but not for violations of business rules.
Effectiveness = Moderate
Manual Dynamic Analysis
Identify error conditions that are not likely to occur during normal usage and trigger them.
For example, run the program under low memory conditions, run with insufficient privileges
or permissions, interrupt a transaction before it is completed, or disable connectivity to basic
network services such as DNS. Monitor the software for any unexpected behavior. If you trigger
an unhandled exception or similar error that was discovered and handled by the application's
environment, it may still indicate unexpected conditions that were not handled by the application
itself.
Potential Mitigations
Phase: Requirements
Strategy = Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make
this weakness easier to avoid. Choose languages with features such as exception handling that
force the programmer to anticipate unusual conditions that may generate exceptions. Custom
exceptions may need to be developed to handle unusual business-logic conditions. Be careful
not to pass sensitive exceptions back to the user (CWE-209, CWE-248).
Phase: Implementation
Check the results of all functions that return a value and verify that the value is expected.
Effectiveness = High
Checking the return value of the function will typically be sufficient, however beware of race
conditions (CWE-362) in a concurrent environment.
Phase: Implementation
If using exception handling, catch and throw specific exceptions instead of overly-general
exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that
exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught
exceptions where feasible (CWE-248).
Effectiveness = High
Using specific exceptions, and ensuring that exceptions are checked, helps programmers to
anticipate and appropriately handle many unusual events that could occur.
Phase: Implementation
Ensure that error messages only contain minimal details that are useful to the intended audience
and no one else. The messages need to strike the balance between being too cryptic (which
can confuse users) or being too detailed (which may reveal more than intended). The messages
should not reveal the methods that were used to determine the error. Attackers can use detailed
information to refine or optimize their original attack, thereby increasing their chances of success.
CWE Version 4.14
CWE-754: Improper Check for Unusual or Exceptional Conditions
CWE-754: Improper Check for Unusual or Exceptional Conditions