COMMON WEAKNESS ENUMERATIONIncomplete

CWE-69

Improper Handling of Windows ::DATA Alternate Data Stream

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

Abstraction

Variant

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

Extended description

An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.

Root cause

How and when does the problem arise?

Lifecycle phase

Implementation

Alternate data streams (ADS) were first implemented in the Windows NT operating system to provide compatibility between NTFS and the Macintosh Hierarchical File System (HFS). In HFS, data and resource forks are used to store information about a file. The data fork provides information about the contents of the file while the resource fork stores metadata such as file type.

Risk

What does successful exploitation lead to?

Bypass Protection MechanismHide ActivitiesOther

Affected security scopes: Access Control, Non-Repudiation, Other

Defence

How is it prevented and fixed?

Implementation

Implementation-phase defence

Detail
Ensure that the source code correctly parses the filename to read or write to the correct stream.

Verification

How is it detected?

Automated Analysis

Software tools are capable of finding ADSs on your system.
CWE-69: Common Weakness Enumeration Entry CWE-69 · DayBreach Sözlük · DayBreach