COMMON WEAKNESS ENUMERATIONDraft

CWE-653

Improper Isolation or Compartmentalization

The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

Soyutlama

Class

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

Genişletilmiş açıklama

When a weakness occurs in functionality that is accessible by lower-privileged users, then without strong boundaries, an attack might extend the scope of the damage to higher-privileged users.

Terminoloji

Alternatif adlar ve kullanım biçimleri

Separation of Privilege

Some people and publications use the term "Separation of Privilege" to describe this weakness, but this term has dual meanings in current usage. This node conflicts with the original definition of "Separation of Privilege" by Saltzer and Schroeder; that original definition is more closely associated with CWE-654. Because there are multiple interpretations, use of the "Separation of Privilege" term is discouraged.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Gain Privileges or Assume IdentityBypass Protection Mechanism

Etkilenen güvenlik alanları: Access Control

The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles.

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
Break up privileges between different modules, objects, or entities. Minimize the interfaces between modules and require strong access control between them.

Doğrulama

Nasıl tespit edilir?

Automated Static Analysis - Binary or Bytecode

SOAR Partial
According to SOAR, the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Compare binary / bytecode to application permission manifest

Manual Static Analysis - Source Code

High
According to SOAR, the following detection techniques may be useful: ``` Highly cost effective: ``` Manual Source Code Review (not inspections) ``` Cost effective for partial coverage: ``` Focused Manual Spotcheck - Focused manual analysis of source

Architecture or Design Review

High
According to SOAR, the following detection techniques may be useful: ``` Highly cost effective: ``` Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal Methods / Correct-By-Construction ``` Cost effective for partial coverage: ``` Attack Modeling
CWE-653: Common Weakness Enumeration Entry CWE-653 · DayBreach Sözlük · DayBreach