CWE

普遍的弱点

社区开发的软件和硬件弱点类型清单

2021 CWE Most Important Hardware Weaknesses
CWE Top 25 Most Dangerous Weaknesses
Home>CWE列表> CWE-单个字典定义(4.9)
ID

CWE-391:未检查的错误条件

弱点ID:391
Abstraction:根据
Structure:Simple
查看自定义信息:
+描述
[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDERCWE-252,CWE-248, ORCWE-1069。] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
+Relationships
Section HelpThis table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
+与观点“研究概念”相关(CWE-1000)
Nature 类型 ID Name
ChildOf Class班级 - 以非常抽象的方式描述的弱点,通常与任何特定的语言或技术无关。比支柱弱点更具体,但比基本弱点更一般。班级弱点通常用以下维度的1或2来描述问题:行为,属性和资源。 754 Improper Check for Unusual or Exceptional Conditions
Section HelpThis table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
+与“软件开发”视图相关(CWE-699)
Nature 类型 ID Name
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 389 Error Conditions, Return Values, Status Codes
Section HelpThis table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
+与“建筑概念”(CWE-1008)有关
Nature 类型 ID Name
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 1020 Verify Message Integrity
Section HelpThis table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
+与“ CISQ质量措施(2020)”相关(CWE-1305)
Nature 类型 ID Name
ChildOf 支柱支柱 - 弱点是最抽象的弱点类型,代表了与之相关的所有类别/基础/变体弱点的主题。从技术上讲,柱子与类别不同,因为在技术上仍然是一种描述错误的弱点,而类别代表用于分组相关事物的常见特征。 703 检查或处理特殊条件不当
Section HelpThis table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
+Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature 类型 ID Name
ChildOf 支柱支柱 - 弱点是最抽象的弱点类型,代表了与之相关的所有类别/基础/变体弱点的主题。从技术上讲,柱子与类别不同,因为在技术上仍然是一种描述错误的弱点,而类别代表用于分组相关事物的常见特征。 703 检查或处理特殊条件不当
+Modes Of Introduction
Section HelpThe different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
阶段 Note
建筑和设计
执行 实现:这种弱点是在实施建筑安全策略期间引起的。
+Applicable Platforms
Section HelpThis listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.

Languages

Class: Not Language-Specific(Undetermined Prevalence)

+Common Consequences
Section HelpThis table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
范围 影响 Likelihood
正直
Other

Technical Impact:随上下文而变化;意外状态;更改执行逻辑

+Likelihood Of Exploit
Medium
+示例的例子

示例1

以下代码摘录忽略了doexchange()的少数次数异常。

(不良代码)
示例语言:Java
尝试 {
doExchange();
}
捕获(rareexception e){

//这永远不会发生
}

如果要抛出Rareexception,该程序将继续执行,好像没有发生任何异常情况。该计划没有记录任何证据表明特殊情况的证据,可能会挫败任何以后解释该计划行为的尝试。

+潜在的缓解

阶段: Requirements

The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.

阶段: Requirements

A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.

阶段:实施

Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
+会员资格
Section Help此成员关系表显示了其他CWE类别和视图,将此弱点称为成员。该信息通常可用于理解弱点适合外部信息源的何处。
Nature 类型 ID Name
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 388 7PK - Errors
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 728 OWASP前十名2004类A7类 - 错误处理不当
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 743 证书C安全编码标准(2008)第10章 - 输入输出(FIO)
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 746 证书C安全编码标准(2008)第13章 - 错误处理(ERR)
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 876 CERT C ++安全编码第08部分 - 内存管理(MEM)
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 877 CERT C ++安全编码第09节 - 输入输出(FIO)
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 880 CERT C ++安全编码第12节 - 异常和错误处理(ERR)
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 962 SFP辅助群集:未检查状态条件
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 1159 SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP)
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 1167 SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR)
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 1171 SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)
成员 类别类别 - 包含共享共同特征的其他条目的CWE条目。 1181 SEI CERT PERL编码标准 - 指南03.表达式(EXP)
+Notes

Other

当程序员忽略异常时,他们隐含地声明他们是根据两个假设之一进行操作的:

  • This method call can never fail.
  • It doesn't matter if this call fails.

Maintenance

该条目定于弃用;它具有CWE分析师的多种广泛解释。目前,它结合了来自三种不同分类法的信息,但是每个分类法都在谈论一个略有不同的问题。CWE分析师可能会根据任何这些问题映射到此条目。7pk具有“空捕获块”,该块具有与空的异常块的关联(CWE-1069);在这种情况下,例外已经执行了检查,但无法处理。在plover中有“未选中的返回值”CWE-252,但是与“空渔获块”不同,甚至没有检查问题的检查 - “未检查的错误条件”意味着缺乏检查。对于扣子,“未被发现的例外”(CWE-248)与错误的错误传播有关 - 至少在CWE 3.2和更早的情况下发现。还有其他与错误处理和检查有关的问题。
+分类映射
Mapped Taxonomy Name Node ID 合身 映射的节点名称
PLOVER 未选中的返回值
7 Pernicious Kingdoms Empty Catch Block
CLASP 未捕获的异常
OWASP 2004年前十名 A7 CWE More Specific Improper Error Handling
证书C安全编码 ERR00-C Adopt and implement a consistent and comprehensive error-handling policy
证书C安全编码 ERR33-C CWE More Abstract 检测和处理标准库错误
证书C安全编码 ERR34-C CWE More Abstract Detect errors when converting a string to a number
证书C安全编码 FLP32-C 不精确 Prevent or detect domain and range errors in math functions
证书C安全编码 POS54-C CWE More Abstract Detect and handle POSIX library errors
SEI CERT Perl Coding Standard EXP31-PL 不精确 Do not suppress or ignore exceptions
Software Fault Patterns SFP4 Unchecked Status Condition
+参考
[Ref-18] Secure Software,Inc.。“ The CLASP应用程序安全过程”。2005年。<https://cwe.mitre.org/documents/sources/theclaspapplicationsecurityprocess.pdf>。
+Content History
+提交
提交日期 Submitter 组织
2006-07-19 PLOVER
+Modifications
Modification Date 修饰符 组织
2008-07-01 Eric Dalci 雪茄
updated Time_of_Introduction
2008-08-01 KDM Analytics
added/updated white box definitions
2008-08-15 Veracode
建议OWASP前十名2004年映射
2008-09-08 CWE内容团队 MITRE
更新的维护_notes,关系,其他_notes,gualomy_mappings
2008-11-24 CWE内容团队 MITRE
更新的关系,分类_mappings
2009-05-27 CWE内容团队 MITRE
更新了示范_examples
2009-07-17 KDM Analytics
Improved the White_Box_Definition
2009-07-27 CWE内容团队 MITRE
updated White_Box_Definitions
2011-06-01 CWE内容团队 MITRE
更新的common_cconsquences
2011-06-27 CWE内容团队 MITRE
更新的common_cconsquences
2011-09-13 CWE内容团队 MITRE
更新的关系,分类_mappings
2012-05-11 CWE内容团队 MITRE
更新的关系
2012-10-30 CWE内容团队 MITRE
更新的势_MINEIGATIONS
2014-06-23 CWE内容团队 MITRE
更新其他_notes
2014-07-30 CWE内容团队 MITRE
更新的关系,分类_mappings
2017-11-08 CWE内容团队 MITRE
更新已更新的适用_platforms,modes_of_introduction,人际关系,分类_ mappings,white_box_definitions
2019-01-03 CWE内容团队 MITRE
更新的关系,分类_mappings
2019-06-20 CWE内容团队 MITRE
更新的描述,维护_notes
2020-02-24 CWE内容团队 MITRE
updated References
2020-08-20 CWE内容团队 MITRE
更新的关系
2020-12-10 CWE内容团队 MITRE
更新的关系
2021-03-15 CWE内容团队 MITRE
updated Description, Relationships
2021-07-20 CWE内容团队 MITRE
更新的关系
提供更多信息 - 请选择其他过滤器。
Page Last Updated:2022年10月13日