679
Consider following the principle of separation of privilege. Require multiple conditions to be met
before permitting access to a system resource.
Demonstrative Examples
Example 1:
This function is part of a privileged program that takes input from users with potentially lower
privileges.
Example Language: Python (Bad)
def killProcess(processID):
os.kill(processID, signal.SIGKILL)
This code does not confirm that the process to be killed is owned by the requesting user, thus
allowing an attacker to kill arbitrary processes.
This function remedies the problem by checking the owner of the process before killing it:
Example Language: Python (Good)
def killProcess(processID):
user = getCurrentUser()
#Check process owner against requesting user
if getProcessOwner(processID) == user:
os.kill(processID, signal.SIGKILL)
return
else:
print("You cannot kill a process you don't own")
return
Observed Examples
Reference Description
CVE-2001-0178 Program does not verify the owner of a UNIX socket that is used for sending a
password.
https://www.cve.org/CVERecord?id=CVE-2001-0178
CVE-2004-2012 Owner of special device not checked, allowing root.
https://www.cve.org/CVERecord?id=CVE-2004-2012
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 884 CWE Cross-section 884 2567
MemberOf 944 SFP Secondary Cluster: Access Management 888 2393
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Relationship
This overlaps insufficient comparison, verification errors, permissions, and privileges.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Unverified Ownership
CWE Version 4.14
CWE-284: Improper Access Control
CWE-284: Improper Access Control