COMMON WEAKNESS ENUMERATIONIncomplete

CWE-67

Improper Handling of Windows Device Names

The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

High

Understand the problem

What is the problem?

The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.

Extended description

Not properly handling virtual filenames (e.g. AUX, CON, PRN, COM1, LPT1) can result in different types of vulnerabilities. In some cases an attacker can request a device via injection of a virtual filename in a URL, which may cause an error that leads to a denial of service or an error page that reveals sensitive information. A product that allows device names to bypass filtering runs the risk of an attacker injecting malicious code in a file with the name of a device.

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

Lifecycle phase

Operation

Historically, there was a bug in the Windows operating system that caused a blue screen of death. Even after that issue was fixed DOS device names continue to be a factor.

Risk

What does successful exploitation lead to?

DoS: Crash, Exit, or RestartRead Application DataOther

Affected security scopes: Availability, Confidentiality, Other

Defence

How is it prevented and fixed?

Implementation

Implementation-phase defence

Detail
Be familiar with the device names in the operating system where your system is deployed. Check input for these device names.