124
Weakness Ordinalities
Resultant :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Windows (Prevalence = Undetermined)
Background Details
Historically, there was a bug in the Windows operating system that caused a blue screen of death.
Even after that issue was fixed DOS device names continue to be a factor.
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Availability
Confidentiality
Other
DoS: Crash, Exit, or Restart
Read Application Data
Other
Potential Mitigations
Phase: Implementation
Be familiar with the device names in the operating system where your system is deployed. Check
input for these device names.
Observed Examples
Reference Description
CVE-2002-0106 Server allows remote attackers to cause a denial of service via a series of
requests to .JSP files that contain an MS-DOS device name.
https://www.cve.org/CVERecord?id=CVE-2002-0106
CWE Version 4.14
CWE-67: Improper Handling of Windows Device Names
CWE-67: Improper Handling of Windows Device Names