COMMON WEAKNESS ENUMERATIONIncomplete

CWE-69

Improper Handling of Windows ::DATA Alternate Data Stream

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

Soyutlama

Variant

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

Genişletilmiş açıklama

An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

Alternate data streams (ADS) were first implemented in the Windows NT operating system to provide compatibility between NTFS and the Macintosh Hierarchical File System (HFS). In HFS, data and resource forks are used to store information about a file. The data fork provides information about the contents of the file while the resource fork stores metadata such as file type.

Risk

Başarılı sömürü neye yol açar?

Bypass Protection MechanismHide ActivitiesOther

Etkilenen güvenlik alanları: Access Control, Non-Repudiation, Other

Savunma

Nasıl önlenir ve çözülür?

Implementation

Uygulama aşaması savunması

Detay
Ensure that the source code correctly parses the filename to read or write to the correct stream.

Doğrulama

Nasıl tespit edilir?

Automated Analysis

Software tools are capable of finding ADSs on your system.