CWE-66 标识虚拟资源的文件名处理不恰当
Improper Handling of File Names that Identify Virtual Resources
结构: Simple
Abstraction: Base
状态: Draft
被利用可能性: unkown
基本描述
The product does not handle or incorrectly handles a file name that identifies a "virtual" resource that is not directly specified within the directory that is associated with the file name, causing the product to perform file-based operations on a resource that is not a file.
扩展描述
Virtual file names are represented like normal file names, but they are effectively aliases for other resources that do not behave like normal files. Depending on their functionality, they could be alternate entities. They are not necessarily listed in directories.
相关缺陷
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Other | Other |
检测方法
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful:
- Bytecode Weakness Analysis - including disassembler + source code weakness analysis
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful:
- Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful:
- Web Application Scanner
- Web Services Scanner
- Database Scanners
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful:
- Fuzz Tester
- Framework-based Fuzzer
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful:
- Focused Manual Spotcheck - Focused manual analysis of source
- Manual Source Code Review (not inspections)
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful:
- Source code Weakness Analyzer
- Context-configured Source Code Weakness Analyzer
Architecture or Design Review
According to SOAR, the following detection techniques may be useful:
- Formal Methods / Correct-By-Construction
- Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| PLOVER | Virtual Files |
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论